onyx --cves cve-2026-32274
CVE-2026-32274
- score
- <0.1
- cvss
- 7.5
- epss
- 0.7%
- published
- 2026-03-12
- kev added
- —
- first seen
Black < 26.3.1 contains an unrestricted file write caused by unsanitized --python-cell-magics option in cache filename computation, letting attackers write cache files to arbitrary file system locations, exploit requires attacker control over the option value.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 13
- https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2026-2121.yaml
- https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d
- https://github.com/psf/black/pull/5038
- https://github.com/psf/black/releases/tag/26.3.1
- https://github.com/psf/black/security/advisories/GHSA-3936-cmfr-pm3m
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13553
- https://bugzilla.redhat.com/show_bug.cgi?id=2447111
- https://access.redhat.com/security/cve/CVE-2026-32274
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32274.json
- https://github.com/psf/black/commit/ed770ba4dd50c419148a0fca2b43937a7447e1f9
- https://github.com/psf/black/pull/4176