CVE-2026-114134: Black: GitHub Action installs unvalidated required-version from pyproject.toml

October 22, 2026

The GitHub Action bundled with Black can read the version from tool.black.required-version if use_pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim’s repository.

References

github.com/advisories/GHSA-cg8m-r9f2-5wm2
github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514
github.com/psf/black/pull/5510
github.com/psf/black/releases/tag/26.10.1
github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2
nvd.nist.gov/vuln/detail/CVE-2026-114134

Code Behaviors & Features

Detect and mitigate CVE-2026-114134 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →