CVE-2026-31900: Black's vulnerable version parsing leads to RCE in GitHub Action
Impact
Black provides a GitHub action for formatting code. This action supports an option, usepyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action.
Patches
Version 26.3.0 fixes this vulnerability by tightening the validation of the version field. Users who use the GitHub Action as psf/black@stable will automatically pick up this update.
Workarounds
Do not use the usepyproject: true option in the psf/black GitHub Action.
Other sources
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, usepyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
actions/psf/blackto a version that resolves this vulnerability.Fixed in 26.3.0 - Upgrade
Upgrade
psf/blackto a version that resolves this vulnerability.Fixed in 26.3.0 - Configuration
Do not use the `use_pyproject: true` option in the psf/black GitHub Action; avoid reading the Black version from repository `pyproject.toml`.
psf/black GitHub Action use_pyproject = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31900?
CVE-2026-31900 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-31900?
To mitigate CVE-2026-31900, upgrade to Black version 26.3.0 or later.
What is affected by CVE-2026-31900?
CVE-2026-31900 affects versions of Black prior to 26.3.0 when using the GitHub action with the 'use_pyproject' option.
What types of systems are vulnerable to CVE-2026-31900?
CVE-2026-31900 impacts systems utilizing affected versions of the Black formatter in GitHub actions.
What is the main impact of CVE-2026-31900?
The main impact of CVE-2026-31900 is the potential for attackers to execute arbitrary code on systems using vulnerable versions of Black.