Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32274 Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The valu… https://www.cve.org/CVERecord?id=CVE-2026-32274
Post summary
The tweet mentions CVE-2026-32274, noting that Black's cache file naming logic before version 26.3.1 may be vulnerable, but it provides no evidence of exploits, PoCs, or mitigations.
CVE-2026-32274 Black Python Formatter Cache File Path Traversal Before 26.3.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32274
Post summary
The entry points out CVE-2026-32274, a path‑traversal flaw in Black Python Formatter before version 26.3.1, but otherwise offers only a brief description and a link without detailed technical info or mitigation steps.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | python | black | - | python | - |