CVE-2026-31900Disclosure(python / black)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch python black systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

python CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611

Vendor / third-party advisories

https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

black

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 2d ago at 3 mentions (2026-03-11); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

python

Products

black

Deep dive

Activity timeline5 mentions / 3d

Signal classification2 categories

Disclosure

360.0%

General

240.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-11	3	Disclosure1General2
2026-03-22	1	Disclosure1
2026-03-29	1	Disclosure1

Full discourse5 posts

White Rabbitx@TheRabbitPy194d
Disclosure
🔥 CVE-2026-31900 (Black <=26.2.0 Python formatter): 9.8 CVSS GitHub Action RCE via malicious pyproject.toml in use_pyproject: true—steals secrets. Patch: 26.3.0+ https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm https://nvd.nist.gov/vuln/detail/CVE-2026-31900 https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm
Post summary
A critical RCE vulnerability (CVE‑2026‑31900) was disclosed for black <=26.2.0, allowing secret theft via a malicious pyproject.toml; it is patched in version 26.3.0+.
2001079
492 followersView on X
White Rabbitx@TheRabbitPy201d
Disclosure
🚨 CVE-2026-31900 (CVSS 9.8): Black Python formatter GitHub Action command injection. Code formatters as attack vector! https://cve.komodosec.com/cve-list?search=&cvss_score_range=9&year=&has_exploit=&results_per_page=15&sort=publish_date&order=asc
Post summary
The tweet announces the new vulnerability CVE‑2026‑31900, highlights its high CVSS score and command injection vector, but provides no PoC, exploit code, active exploitation evidence, or patch information.
0102071
374 followersView on X
CVE@CVEnew212d
General
CVE-2026-31900 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for readin… https://www.cve.org/CVERecord?id=CVE-2026-31900
Post summary
The post merely cites the CVE record for Black, the Python formatter, without supplying any technical details, PoC, exploit, or mitigation information.
00001276
56.6K followersView on X
Infoflowcloud@infoflowcloud212d
General
🚨*CVE* CVE-2026-31900 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for readin… https://www.cve.org/CVERecord?id=CVE-2026-31900 ----- Traducción: CVE-2026-31900 Bla… http://infoflow.cloud`
Post summary
The snippet references CVE‑2026‑31900 and provides a brief description of the affected tool and a link to its record, but offers no concrete details on exploitation, remediation, or the nature of the vulnerability.
0000038
57 followersView on X
‘BBWriteups’@bbwriteup213d
Disclosure
"CVE-2026–31900: How a Permissive Regex Led to RCE in psf/black’s GitHub Action" by Tommaso Bona #BugBounty #Cybersecurity #Hacking #InfoSec https://medium.com/securitycertcommunity/cve-2026-31900-50800bafafba
Post summary
The post references a Medium article describing CVE‑2026‑31900, a permissive regex vulnerability in psf/black’s GitHub Action that results in remote code execution.
0000046
502 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	python	black	-	-	-

Explore more

Back to dashboard python CVEs black vulnerabilities

What researchers are saying

CVE-2026-31900

White Rabbitx[verified]@TheRabbitPyDisclosure

A critical RCE vulnerability (CVE‑2026‑31900) was disclosed for black <=26.2.0, allowing secret theft via a malicious pyproject.toml; it is patched in version 26.3.0+.

White Rabbitx[verified]@TheRabbitPyDisclosure

The tweet announces the new vulnerability CVE‑2026‑31900, highlights its high CVSS score and command injection vector, but provides no PoC, exploit code, active exploitation evidence, or patch information.

CVE@CVEnewGeneral

The post merely cites the CVE record for Black, the Python formatter, without supplying any technical details, PoC, exploit, or mitigation information.

Infoflowcloud@infoflowcloudGeneral

The snippet references CVE‑2026‑31900 and provides a brief description of the affected tool and a link to its record, but offers no concrete details on exploitation, remediation, or the nature of the vulnerability.

‘BBWriteups’@bbwriteupDisclosure

The post references a Medium article describing CVE‑2026‑31900, a permissive regex vulnerability in psf/black’s GitHub Action that results in remote code execution.