Skip to content
fr Sign in
8.7 High

CVE-2026-32274 Black is the uncompromising Python code formatter

Description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2.5 1777403872 earliest → < 1777403872 1777403872
Red Hat Ansible Automation Platform 2.6 1777390333 earliest → < 1777390333 1777390333
Red Hat OpenShift AI 2.25 1776319275 earliest → < 1776319275 1776319275
OpenShift Lightspeed Versions not published
Red Hat Ansible Automation Platform Ansible Core 2 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
black 24.3 24.3.0 → < 26.3.1 26.3.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Ansible Automation Platform 2.5

The 33 CVEs of Red Hat Ansible Automation Platform 2.5 →
CVE-2026-11807 Eda-server: websocket missing authorization allows credential theft via activation_id spoofing 9.6 Critical CVE-2026-11332 Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution 7.8 High CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 6.4 Medium CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved… 4.1 Medium
Track this CVE