Black: GitHub Action remote code execution via pyproject.toml (CVE-2026-114134)
The GitHub Action bundled with Black fails to validate the required-version parameter from pyproject.toml when use_pyproject is enabled, allowing for the execution of untrusted code in the GitHub Actions runner environment.
CVE search metadata
CVE search record: CVE-2026-114134. KEV: no. Product: black (< 26.10.1). Brief: Black: GitHub Action remote code execution via pyproject.toml (CVE-2026-114134). Brief link: https://feed.craftedsignal.io/briefs/2026-10-black-github-action-rce/
Triage facts
Revision 1- Applicability
- black (< 26.10.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 20:03 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The GitHub Action bundled with Black reads the version from 'tool.black.required-version' when 'use_pyproject' is set to True. This value is not validated and can be used to execute untrusted code in the context of a victim's repository. Successful exploitation requires a victim to use the Black GitHub Action with 'use_pyproject: true', and an attacker to submit a pull request with a modified 'pyproject.toml' file.