CVE-2026-32274: psf black Path Traversal

Vulnerability summary

CVE-2026-32274 is a high (CVSS 8.7) Path Traversal vulnerability in psf black. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.9% of scored vulnerabilities.

Timeline

1. 12-03-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.