CVE-2026-114134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114134", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-20T21:53:58.473Z", "datePublished": "2026-11-05T20:22:14.467Z", "dateUpdated": "2026-11-09T17:42:32.837Z"}, "containers": {"cna": {"title": "Black: GitHub Action installs unvalidated required-version from pyproject.toml", "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2"}, {"name": "https://github.com/psf/black/pull/5510", "tags": ["x_refsource_MISC"], "url": "https://github.com/psf/black/pull/5510"}, {"name": "https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514", "tags": ["x_refsource_MISC"], "url": "https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514"}], "affected": [{"vendor": "psf", "product": "black", "versions": [{"version": "< 26.10.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:22:14.467Z"}, "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1."}], "source": {"advisory": "GHSA-cg8m-r9f2-5wm2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:37:05.046230Z", "id": "CVE-2026-114134", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:42:32.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114134", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T17:37:05.046230Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:37:06.444Z"}}], "cna": {"title": "Black: GitHub Action installs unvalidated required-version from pyproject.toml", "source": {"advisory": "GHSA-cg8m-r9f2-5wm2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "psf", "product": "black", "versions": [{"status": "affected", "version": "< 26.10.1"}]}], "references": [{"url": "https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2", "name": "https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/psf/black/pull/5510", "name": "https://github.com/psf/black/pull/5510", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514", "name": "https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:22:14.467Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114134", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:42:32.837Z", "dateReserved": "2026-10-20T21:53:58.473Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T20:22:14.467Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "black", "vendor": "psf", "versions": [{"status": "affected", "version": "< 26.10.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1."}], "id": "CVE-2026-114134", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114134", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:37:05.046230Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:36.887", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514"}, {"source": "security-advisories@github.com", "url": "https://github.com/psf/black/pull/5510"}, {"source": "security-advisories@github.com", "url": "https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "black: Black: Arbitrary code execution via unvalidated version specification in GitHub Action", "id": "2567838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567838"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-829", "details": ["A flaw was found in the Black GitHub Action. When configured to read project settings from a configuration file, the action fails to validate the specified version identifier. A remote attacker capable of submitting a pull request can supply a reference to external malicious code, leading to arbitrary code execution within the victim repository's continuous integration (CI) workflow environment."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-114134", "public_date": "2026-11-05T20:22:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114134\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114134\nhttps://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514\nhttps://github.com/psf/black/pull/5510\nhttps://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2"], "statement": "This vulnerability is rated as Important because an untrusted contributor submitting a pull request can achieve arbitrary code execution inside the build runner environment without requiring administrative privileges. Red Hat enterprise products do not distribute or execute the upstream GitHub Action, and standalone deployments of the Black formatting utility on Red Hat platforms remain unaffected by this flaw. The exposure is confined strictly to external automated continuous integration workflows configured to load version specifications dynamically from repository files.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.10.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "black", "source": "cna", "vendor": "psf"}, "product": "black", "vendor": "psf"}], "created": "2026-11-05T21:45:04.829852+00:00", "updated": "2026-11-05T22:15:14.895880+00:00", "vendors": ["psf", "psf$PRODUCT$black"]}