Path Traversal in Psf Black
CVE-2026-32274
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- Psf Black — versions < 26.3.1, >= 24.3.0, < 26.3.1
- Python Black
Weakness classification (CWE)
References
- github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m (Vendor Advisory)
- github.com/psf/black/pull/5038 (Patch, Issue Tracking)
- github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d (Patch)
- github.com/psf/black/releases/tag/26.3.1 (Release Notes)
- access.redhat.com/errata/RHSA-2026:10184
- access.redhat.com/errata/RHSA-2026:13545
- access.redhat.com/errata/RHSA-2026:13553
- access.redhat.com/security/cve/CVE-2026-32274
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json
Frequently asked questions
- What is CVE-2026-32274?
- CVE-2026-32274 is a high-severity vulnerability in Psf Black, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-03-12.
- How severe is CVE-2026-32274?
- High severity. CVSS v3 base score is 7.5 out of 10.