Black (< 26.10.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/black--26.10.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 20:03:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBlack: GitHub Action remote code execution via pyproject.toml (CVE-2026-114134)https://feed.craftedsignal.io/briefs/2026-10-black-github-action-rce/Thu, 22 Oct 2026 20:03:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-black-github-action-rce/The GitHub Action bundled with Black fails to validate the required-version parameter from pyproject.toml when use_pyproject is enabled, allowing for the execution of untrusted code in the GitHub Actions runner environment.<p>The GitHub Action bundled with Black reads the version from 'tool.black.required-version' when 'use_pyproject' is set to True. This value is not validated and can be used to execute untrusted code in the context of a victim's repository. Successful exploitation requires a victim to use the Black GitHub Action with 'use_pyproject: true', and an attacker to submit a pull request with a modified 'pyproject.toml' file.</p> highadvisory