CVE catalog

CVE-2026-31900

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Mar 11, 2026, 8:16:15 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.48% · Oct 25, 2026

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	black	sid	`26.10.1-1`	vulnerable
Debian	black	forky	`26.10.1-1`	vulnerable
Debian	black	trixie	`25.1.0-3+deb13u1`	vulnerable
Debian	black	bookworm	`23.1.0-1`	vulnerable
Cpe	black	Not reported	Not reported	vulnerable
Suse	python-black	linux enterprise server 16.0	`25.1.0-160000.3.1`	fixed
Suse	python-black	linux enterprise server for sap applications 16.0	`25.1.0-160000.3.1`	fixed
Opensuse	python-black	leap 16.0	`25.1.0-160000.3.1`	fixed
Opensuse	python-black	tumbleweed	`26.3.1-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	black	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	black	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	black	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	black	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Suse	python-black	rpm	linux enterprise server 16.0	`25.1.0-160000.3.1`	Not reported	SUSE-SU-2026:20928-1	Not reported
Suse	python-black	rpm	linux enterprise server for sap applications 16.0	`25.1.0-160000.3.1`	Not reported	SUSE-SU-2026:20928-1	Not reported
Opensuse	python-black	rpm	leap 16.0	`25.1.0-160000.3.1`	Not reported	OPENSUSE-SU-2026:20417-1	Not reported
Opensuse	python-black	rpm	tumbleweed	`26.3.1-1.1`	Not reported	OPENSUSE-SU-2026:10372-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[black]Affected
Details (2)
- 23.1.0-1 · all · bookworm
  Affected
  nvd · black · debian · bookworm; nvd · black · debian · 12
- 23.1.0-1 · all · bookworm
  Affected
  nvd · black · debian · bookworm; nvd · black · debian · 12
[python-black-doc]Affected
Source package: [black]
Details (2)
- 23.1.0-1 · all · bookworm
  Affected
  nvd · black · debian · bookworm; nvd · black · debian · 12
- 23.1.0-1 · all · bookworm
  Affected
  nvd · black · debian · bookworm; nvd · black · debian · 12

[Debian 13 (Trixie)]

[black]Affected
Details (2)
- 25.1.0-3+deb13u1 · amd64 · trixie
  Affected
  nvd · black · debian · 13
- 25.1.0-3+deb13u1 · arm64 · trixie
  Affected
  nvd · black · debian · 13
[python-black-doc]Affected
Source package: [black]
Details (2)
- 25.1.0-3+deb13u1 · all · trixie
  Affected
  nvd · black · debian · 13
- 25.1.0-3+deb13u1 · all · trixie
  Affected
  nvd · black · debian · 13

[openSUSE Tumbleweed]

[python313-black]Unknown
Source package: [python-black]
Details (1)
- 26.5.1-1.3 · noarch · tumbleweed
  Unknown · Fixed: 26.3.1-1.1
  Version impact unknown
  nvd · python-black · opensuse · tumbleweed
[python314-black]Unknown
Source package: [python-black]
Details (1)
- 26.5.1-1.3 · noarch · tumbleweed
  Unknown · Fixed: 26.3.1-1.1
  Version impact unknown
  nvd · python-black · opensuse · tumbleweed

Observed: Oct 24, 2026, 12:37:16 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]