PyPI/black CVE-2026-114134: high
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Action: Upgrade black to 26.10.1 or later.
pip install black==26.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 26.10.1 | - |
Fixed versions
| 26.10.1 |
Sources
- osv: GHSA-cg8m-r9f2-5wm2
- https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2
- https://github.com/psf/black/pull/5510
- https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514
- https://github.com/psf/black
- https://github.com/psf/black/releases/tag/26.10.1
CVE-2026-114134 · published · modified · JSON