HIGH GitHub
CVE-2026-114134
Black: GitHub Action installs unvalidated required-version from pyproject.toml
### Summary
The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.
### Details
This is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.
### Proof of concept
Reproduction requires a victim
Affected Products
- pip/black < 26.10.1
References
- https://github.com/advisories/GHSA-cg8m-r9f2-5wm2
- https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2
- https://github.com/psf/black/pull/5510
- https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514
This high severity vulnerability was published on 2026-10-22 via GitHub. Affected: pip/black < 26.10.1.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.