CVE-2026-32274

HIGH7.5EPSS 0.02%

Black: Arbitrary file writes from unsanitized user input in cache file name

發布日:2026/3/12修改日:2026/3/16
也稱為:GHSA-3936-cmfr-pm3mCGA-fhc2-gph6-prwr

描述

### Impact Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. ### Patches Fixed in Black 26.3.1. ### Workarounds Do not allow untrusted user input into the value of the `--python-cell-magics` option.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
osvCVSS 3.1HIGH7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

參考連結(7)