← Vulnerability feed

Vulnerability record · CVE-2026-32274 · published 12 March 2026

CVE-2026-32274: Python black path traversal vulnerability

Python · Black

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

8.7 CVSS 4.0 High EPSS 0.72% · top 48.1% CWE-22 · Path traversal
8.7CVSS 4.0 base score
0.72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
19References
3 Aug 2026Last modified by NVD

Description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:10184
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:13553
https://access.redhat.com/security/cve/CVE-2026-32274
https://bugzilla.redhat.com/show_bug.cgi?id=2447111
https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d Patch
https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9
https://github.com/psf/black/pull/4176
https://github.com/psf/black/pull/5038 Issue TrackingPatch
https://github.com/psf/black/releases/tag/26.3.1 Release Notes
https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m Vendor Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json
https://access.redhat.com/errata/RHSA-2026:10184
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:13553
https://access.redhat.com/security/cve/CVE-2026-32274
https://bugzilla.redhat.com/show_bug.cgi?id=2447111
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json

Track CVE-2026-32274 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-31900Python black improper input validation vulnerabilityBlack is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject:…EPSS 0.64%9.8CVE-2026-93616Checkpoint multi-domain security management path traversal vulnerabilityA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Managem…KEVEPSS 20%10.0CVE-2026-85706GitLab CE/EE repository commits API path traversal allows unauthenticated file readGitLab CE/EE contains improper path confinement and missing authentication enforcement in the repository commits API, allowing an unauthenticated use…KEVEPSS 91%analysed5.3CVE-2026-66384JFrog Artifactory path traversal in Docker cache pathAn authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions in JFrog Artifactory. The fla…KEVEPSS 0.66%analysed9.8CVE-2026-59310VMware vCenter Syslog server path traversal leads to RCEVMware vCenter's Syslog server is affected by a directory traversal flaw (CWE-22) that allows a remote, unauthenticated attacker to execute arbitrary…KEVEPSS 2.6%analysed10.0CVE-2026-48282Adobe ColdFusion path traversal leads to remote code executionColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal flaw (CWE-22) that allows an unauthenticated remote attacker to reach files …KEVEPSS 42%analysed10.0CVE-2026-34909UniFi OS path traversal allows unauthenticated file accessUniFi OS devices contain a path traversal flaw (CWE-22) that lets a network-reachable attacker read files on the underlying system. Because the expos…KEVEPSS 1.8%analysed6.5CVE-2026-20262Cisco Catalyst SD-WAN Manager path traversal in file uploadCisco Catalyst SD-WAN Manager (formerly vManage) fails to properly validate user-supplied input during a file upload process, allowing path traversal…KEVEPSS 28%analysed

Source: NIST National Vulnerability Database (record CVE-2026-32274), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.