--- id: CVE-2026-32274 title: >- black: Black: Arbitrary file writes from unsanitized user input in cache file name (CVE-2026-32274) summary: >- A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N' cvssSource: vendor cwe: CWE-22 vendor: Red Hat product: Red Hat Ansible Automation Platform 2.6 affected: - openshift_lightspeed - ansible_automation_platform_ansible_core 2 - openshift_ai_rhoai - openshift_virtualization 4 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - openshift_ai 2.25 - openshift_ai 3.3 patched: - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - openshift_ai 2.25 - openshift_ai 3.3 published: '2026-03-12' updated: '2026-10-15' sourceUpdated: '2026-10-15T10:47:29+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json - url: 'https://access.redhat.com/security/cve/CVE-2026-32274' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2447111' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-32274' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32274' - url: >- https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d - url: 'https://github.com/psf/black/pull/5038' - url: 'https://github.com/psf/black/releases/tag/26.3.1' - url: 'https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m' - url: 'https://access.redhat.com/errata/RHSA-2026:13553' - url: 'https://access.redhat.com/errata/RHSA-2026:13545' - url: 'https://access.redhat.com/errata/RHSA-2026:10184' - url: 'https://access.redhat.com/errata/RHSA-2026:73987' - url: 'https://github.com/psf/black/pull/4176' - url: >- https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9 - url: 'https://github.com/psf/black' - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml tags: - csaf - vex - red-hat - osv - pip epss: 0.00632 epssPercentile: 0.50073 aliases: - GHSA-3936-cmfr-pm3m - PYSEC-2026-2121 ecosystem: pip ingestedAt: '2026-07-13T18:57:51.775Z' --- ## Overview A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. ## Vendor advisories - **RHSA-2026:13553** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13553) - **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4 · no fix planned: Red Hat OpenShift Virtualization 4, OpenShift Lightspeed, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json) **black: Black: Arbitrary file writes from unsanitized user input in cache file name** — rated Important by Red Hat. Released 2026-03-12, updated 2026-10-15. Affected: - OpenShift Lightspeed - Red Hat Ansible Automation Platform Ansible Core 2 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Virtualization 4 Fixed: - Red Hat Ansible Automation Platform 2.5 - Red Hat Ansible Automation Platform 2.6 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift AI 3.3 No fix planned: - Red Hat OpenShift Virtualization 4 - OpenShift Lightspeed - Red Hat Ansible Automation Platform Ansible Core 2 - Red Hat OpenShift AI (RHOAI) Not affected: - Red Hat Ansible Automation Platform 2.5 - Red Hat Ansible Automation Platform 2.6 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift AI 3.3 - Red Hat Ansible Automation Platform 2 - Red Hat OpenShift AI (RHOAI) ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading https://access.redhat.com/errata/RHSA-2026:13553 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:13545 For Red Hat OpenShift AI 2.25.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:10184 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-32274) Affected packages: - `black >= 24.3.0, < 26.3.1` Patched in: - `black 26.3.1` Source: https://osv.dev/vulnerability/GHSA-3936-cmfr-pm3m