Black GitHub Action installs unvalidated required-version, allowing code execution
Someone else's code can run in a Python formatter's GitHub automation.
Summary
The Black GitHub Action with use_pyproject: true installs the tool.black.required-version value from pyproject.toml without validation. An attacker who can submit a pull request can make the workflow run attacker-controlled code in the victim repository's GitHub Actions context.
Affected when
- Black GitHub Action with use_pyproject: true
- a repository that accepts pull requests from attackers
What to do
Update Black to 26.10.1.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen