Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

GitHub Actions package

psf/black

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7GitHub ActionsAmendedPublished

    Black's vulnerable version parsing leads to RCE in GitHub Action

    CVE-2026-31900 · GHSA-v53h-f6m7-xcgm

    Affected
    • GitHub Actions psf/black < 26.3.0
    Fixed in
    26.3.0· Vendor fix available
    Issue
    Impact Black provides a GitHub action for formatting code. This action supports an option, usepyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Patches Version 26.3.0 fixes this vulnerability by tightening the validation of the version field. Users who use the GitHub Action as psf/black@stable will automatically pick up this update. Workarounds Do not use the usepyproject: true option in the psf/black GitHub Action.

    Recommended action: Upgrade to 26.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →