Answer in brief
CVE-2026-32274 records a High severity (CVSS 7.5) path traversal vulnerability in Black: Arbitrary file writes from unsanitized user input in cache file name. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-32274 records a High severity (CVSS 7.5) path traversal vulnerability in Black: Arbitrary file writes from unsanitized user input in cache file name. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update black to 26.3.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-32274 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| blackpip | >=24.3.0,<26.3.1 | 26.3.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-32274 records a High severity (CVSS 7.5) path traversal vulnerability in Black: Arbitrary file writes from unsanitized user input in cache file name. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for black.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate black to 26.3.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-32274 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| blackpip | >=24.3.0,<26.3.1 | 26.3.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-32274 records a High severity (CVSS 7.5) path traversal vulnerability in Black: Arbitrary file writes from unsanitized user input in cache file name. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for black.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Impact Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. ### Patches Fixed in Black 26.3.1. ### Workarounds Do not allow untrusted user input into the value of the `--python-cell-magics` option.
### Impact Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. ### Patches Fixed in Black 26.3.1. ### Workarounds Do not allow untrusted user input into the value of the `--python-cell-magics` option.