CVE-2026-114134

— UNSCOREDpublic exploit available

Published 2026-11-05 · Updated 2026-11-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.

Weaknesses

CWE-829

Public exploit & PoC references

https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514
https://github.com/psf/black/pull/5510
https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2

All references

https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514
https://github.com/psf/black/pull/5510
https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2023-7357
HIGHCVE-2026-100256
CRITICALCVE-2026-104056
UNSCOREDCVE-2026-104809
UNSCOREDCVE-2026-104811
CRITICALCVE-2026-105080PoC
UNSCOREDCVE-2026-105331
HIGHCVE-2026-105677PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.