{"id":"CVE-2026-32274","title":"black: Black: Arbitrary file writes from unsanitized user input in cache file name (CVE-2026-32274)","summary":"A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","affected":["openshift_lightspeed","ansible_automation_platform_ansible_core 2","openshift_ai_rhoai","openshift_virtualization 4","ansible_automation_platform 2.5","ansible_automation_platform 2.6","openshift_ai 2.25","openshift_ai 3.3"],"patched":["ansible_automation_platform 2.5","ansible_automation_platform 2.6","openshift_ai 2.25","openshift_ai 3.3"],"published":"2026-03-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T10:47:29+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32274"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447111"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32274"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32274"},{"url":"https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d"},{"url":"https://github.com/psf/black/pull/5038"},{"url":"https://github.com/psf/black/releases/tag/26.3.1"},{"url":"https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m"},{"url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"url":"https://access.redhat.com/errata/RHSA-2026:73987"},{"url":"https://github.com/psf/black/pull/4176"},{"url":"https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9"},{"url":"https://github.com/psf/black"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00632,"epssPercentile":0.50073,"aliases":["GHSA-3936-cmfr-pm3m","PYSEC-2026-2121"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:51.775Z","slug":"CVE-2026-32274","body":"## Overview\n\nA user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.\n\n## Vendor advisories\n\n- **RHSA-2026:13553** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13553)\n- **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545)\n- **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184)\n- **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4 · no fix planned: Red Hat OpenShift Virtualization 4, OpenShift Lightspeed, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json)\n\n**black: Black: Arbitrary file writes from unsanitized user input in cache file name** — rated Important by Red Hat. Released 2026-03-12, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n\nNo fix planned:\n\n- Red Hat OpenShift Virtualization 4\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform Ansible Core 2\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading https://access.redhat.com/errata/RHSA-2026:13553\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:13545\nFor Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-32274)\n\nAffected packages:\n\n- `black >= 24.3.0, < 26.3.1`\n\nPatched in:\n\n- `black 26.3.1`\n\nSource: https://osv.dev/vulnerability/GHSA-3936-cmfr-pm3m","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201600,"id":"CVE-2026-32274","ts":1789399517355,"field":"cvss","old":null,"new":"7.5"},{"seq":200332,"id":"CVE-2026-32274","ts":1789397102355,"field":"cvss","old":"7.5","new":null},{"seq":198256,"id":"CVE-2026-32274","ts":1789391751393,"field":"cvss","old":null,"new":"7.5"},{"seq":196049,"id":"CVE-2026-32274","ts":1789383401863,"field":"cvss","old":"7.5","new":null},{"seq":194978,"id":"CVE-2026-32274","ts":1789380314520,"field":"cvss","old":null,"new":"7.5"},{"seq":193765,"id":"CVE-2026-32274","ts":1789378271314,"field":"cvss","old":"7.5","new":null},{"seq":192552,"id":"CVE-2026-32274","ts":1789376235375,"field":"cvss","old":null,"new":"7.5"},{"seq":191339,"id":"CVE-2026-32274","ts":1789373133148,"field":"cvss","old":"7.5","new":null},{"seq":190124,"id":"CVE-2026-32274","ts":1789369123144,"field":"cvss","old":null,"new":"7.5"},{"seq":188911,"id":"CVE-2026-32274","ts":1789368040830,"field":"cvss","old":"7.5","new":null},{"seq":187694,"id":"CVE-2026-32274","ts":1789364998483,"field":"cvss","old":null,"new":"7.5"},{"seq":186481,"id":"CVE-2026-32274","ts":1789363008952,"field":"cvss","old":"7.5","new":null},{"seq":185267,"id":"CVE-2026-32274","ts":1789360971715,"field":"cvss","old":null,"new":"7.5"},{"seq":184054,"id":"CVE-2026-32274","ts":1789357945854,"field":"cvss","old":"7.5","new":null},{"seq":182306,"id":"CVE-2026-32274","ts":1789354099873,"field":"cvss","old":null,"new":"7.5"},{"seq":181099,"id":"CVE-2026-32274","ts":1789352949708,"field":"cvss","old":"7.5","new":null},{"seq":179892,"id":"CVE-2026-32274","ts":1789350003456,"field":"cvss","old":null,"new":"7.5"},{"seq":178685,"id":"CVE-2026-32274","ts":1789347820595,"field":"cvss","old":"7.5","new":null},{"seq":177478,"id":"CVE-2026-32274","ts":1789346183648,"field":"cvss","old":null,"new":"7.5"},{"seq":176271,"id":"CVE-2026-32274","ts":1789342754230,"field":"cvss","old":"7.5","new":null},{"seq":176055,"id":"CVE-2026-32274","ts":1789342360813,"field":"cvss","old":null,"new":"7.5"},{"seq":175595,"id":"CVE-2026-32274","ts":1789338392301,"field":"cvss","old":"7.5","new":null},{"seq":174390,"id":"CVE-2026-32274","ts":1789334606757,"field":"cvss","old":null,"new":"7.5"},{"seq":173185,"id":"CVE-2026-32274","ts":1789333221954,"field":"cvss","old":"7.5","new":null},{"seq":171999,"id":"CVE-2026-32274","ts":1789330888504,"field":"cvss","old":null,"new":"7.5"},{"seq":170813,"id":"CVE-2026-32274","ts":1789328401385,"field":"cvss","old":"7.5","new":null},{"seq":169608,"id":"CVE-2026-32274","ts":1789326912936,"field":"cvss","old":null,"new":"7.5"},{"seq":168403,"id":"CVE-2026-32274","ts":1789323447724,"field":"cvss","old":"7.5","new":null},{"seq":167198,"id":"CVE-2026-32274","ts":1789319378084,"field":"cvss","old":null,"new":"7.5"},{"seq":165993,"id":"CVE-2026-32274","ts":1789318293557,"field":"cvss","old":"7.5","new":null},{"seq":164788,"id":"CVE-2026-32274","ts":1789315547287,"field":"cvss","old":null,"new":"7.5"},{"seq":163583,"id":"CVE-2026-32274","ts":1789313265508,"field":"cvss","old":"7.5","new":null},{"seq":162378,"id":"CVE-2026-32274","ts":1789311716419,"field":"cvss","old":null,"new":"7.5"},{"seq":161173,"id":"CVE-2026-32274","ts":1789308270942,"field":"cvss","old":"7.5","new":null},{"seq":160678,"id":"CVE-2026-32274","ts":1789304198114,"field":"cvss","old":null,"new":"7.5"},{"seq":158516,"id":"CVE-2026-32274","ts":1789299288431,"field":"cvss","old":"7.5","new":null},{"seq":157480,"id":"CVE-2026-32274","ts":1789296470717,"field":"cvss","old":null,"new":"7.5"},{"seq":156275,"id":"CVE-2026-32274","ts":1789294391141,"field":"cvss","old":"7.5","new":null},{"seq":155070,"id":"CVE-2026-32274","ts":1789292646920,"field":"cvss","old":null,"new":"7.5"},{"seq":153865,"id":"CVE-2026-32274","ts":1789289353953,"field":"cvss","old":"7.5","new":null},{"seq":153077,"id":"CVE-2026-32274","ts":1789285265935,"field":"cvss","old":null,"new":"7.5"},{"seq":148011,"id":"CVE-2026-32274","ts":1789270883684,"field":"cvss","old":"7.5","new":null},{"seq":146051,"id":"CVE-2026-32274","ts":1789269180813,"field":"cvss","old":null,"new":"7.5"},{"seq":144954,"id":"CVE-2026-32274","ts":1789266111702,"field":"cvss","old":"7.5","new":null},{"seq":143858,"id":"CVE-2026-32274","ts":1789262451924,"field":"cvss","old":null,"new":"7.5"},{"seq":142694,"id":"CVE-2026-32274","ts":1789261196582,"field":"cvss","old":"7.5","new":null},{"seq":141530,"id":"CVE-2026-32274","ts":1789258621677,"field":"cvss","old":null,"new":"7.5"},{"seq":140332,"id":"CVE-2026-32274","ts":1789256411327,"field":"cvss","old":"7.5","new":null},{"seq":139134,"id":"CVE-2026-32274","ts":1789254594438,"field":"cvss","old":null,"new":"7.5"},{"seq":137936,"id":"CVE-2026-32274","ts":1789251595509,"field":"cvss","old":"7.5","new":null}]}