CVE-2026-31900

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31900", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T21:59:02.689Z", "datePublished": "2026-03-11T19:15:20.822Z", "dateUpdated": "2026-03-13T03:55:48.806Z"}, "containers": {"cna": {"title": "Black's vulnerable version parsing leads to RCE in GitHub Action", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm"}, {"name": "https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611", "tags": ["x_refsource_MISC"], "url": "https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611"}], "affected": [{"vendor": "psf", "product": "black", "versions": [{"version": "< 26.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:15:20.822Z"}, "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability."}], "source": {"advisory": "GHSA-v53h-f6m7-xcgm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-31900"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T03:55:48.806Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31900", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T19:59:34.869484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:59:38.486Z"}}], "cna": {"title": "Black's vulnerable version parsing leads to RCE in GitHub Action", "source": {"advisory": "GHSA-v53h-f6m7-xcgm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "psf", "product": "black", "versions": [{"status": "affected", "version": "< 26.3.0"}]}], "references": [{"url": "https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm", "name": "https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611", "name": "https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:15:20.822Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31900", "state": "PUBLISHED", "dateUpdated": "2026-03-13T03:55:48.806Z", "dateReserved": "2026-03-09T21:59:02.689Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T19:15:20.822Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "black", "vendor": "psf", "versions": [{"status": "affected", "version": "< 26.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:python:black:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B156B90-4B50-44ED-A82A-0466FD506870", "versionEndExcluding": "26.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability."}, {"lang": "es", "value": "Black es el formateador de c\u00f3digo Python intransigente. Black proporciona una acci\u00f3n de GitHub para formatear c\u00f3digo. Esta acci\u00f3n admite una opci\u00f3n, use_pyproject: true, para leer la versi\u00f3n de Black a utilizar desde el archivo pyproject.toml del repositorio. Una solicitud de extracci\u00f3n maliciosa podr\u00eda editar pyproject.toml para usar una referencia de URL directa a un repositorio malicioso. Esto podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto de la Acci\u00f3n de GitHub. Los atacantes podr\u00edan entonces obtener acceso a secretos o permisos disponibles en el contexto de la acci\u00f3n. La versi\u00f3n 26.3.0 corrige esta vulnerabilidad."}], "id": "CVE-2026-31900", "lastModified": "2026-06-17T10:34:43.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31900", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-11T20:16:15.960", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "black", "source": "cna", "vendor": "psf"}, "product": "black", "vendor": "psf"}], "analysis": {"en": {"generated_at": "2026-03-16T23:11:10.349464+00:00", "value": {"mitigation_remediation": ["Upgrade Black to version 26.3.0 or later. If an upgrade is not immediately possible, disable use_pyproject: true in the GitHub Action workflow or reject pyproject.toml changes that reference external URLs."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Vendor psf: black, product Black code formatter and GitHub Action. The vulnerability affects all deployments that use Black in GitHub Actions with use_pyproject: true and any Black version earlier than 26.3.0. No specific sub-version details are provided beyond the fix in 26.3.0.", "description_and_impact": "The vulnerability is in Black's GitHub Action when the use_pyproject option is enabled. The action reads pyproject.toml from the repository and interprets a direct URL as the source of the Black executable. An attacker who can submit a pull request can modify pyproject.toml to point to a malicious repository. This results in arbitrary code execution within the action runtime, allowing the attacker to access secrets or other permissions that the action possesses. The weakness stems from improper input validation (CWE-20).", "risk_and_exploitability": "The CVSS score is 8.7, indicating a high severity of potential impact. The EPSS score is less than 1%, suggesting the exploit probability is currently low, and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is a malicious pull request that modifies pyproject.toml to reference an attacker-controlled repository. Exploitation requires the attacker to have the ability to forge a pull request, which is feasible for core contributors or attackers with compromised credentials. Once exploited, the attacker can execute arbitrary commands in the action environment."}}}}, "created": "2026-03-12T09:56:46.716941+00:00", "updated": "2026-03-20T15:29:21.366956+00:00", "vendors": ["psf", "psf$PRODUCT$black"]}