python-black security update
The uncompromising code formatter Security Fix(es): Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.(CVE-2026-32274)
OESA-2026-4064
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OESA-2026-4064
python-black
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 24.2.0-3.oe2403sp3
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "24.2.0-3.oe2403sp3"
}
]
}
],
"package": {
"name": "python-black",
"purl": "pkg:rpm/openEuler/python-black&distro=openEuler-24.03-LTS-SP3",
"ecosystem": "openEuler:24.03-LTS-SP3"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4064.json"
},
"ecosystem_specific": {
"src": [
"python-black-24.2.0-3.oe2403sp3.src.rpm"
],
"noarch": [
"python3-black-24.2.0-3.oe2403sp3.noarch.rpm"
]
}
}
]Publisher severity
high
Source reference: /database_specific/severity
- Event
- #14737 · Revision 1
- Added to Heist Feed
- Publisher date