Aller au contenu
en Se connecter
8.7 Élevée

CVE-2026-32274 Black is the uncompromising Python code formatter

Description

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Ansible Automation Platform 2.5 1777403872 premières → < 1777403872 1777403872
Red Hat Ansible Automation Platform 2.6 1777390333 premières → < 1777390333 1777390333
Red Hat OpenShift AI 2.25 1776319275 premières → < 1776319275 1776319275
OpenShift Lightspeed Versions non publiées
Red Hat Ansible Automation Platform Ansible Core 2 Versions non publiées
Red Hat OpenShift AI (RHOAI) Versions non publiées
Red Hat OpenShift Virtualization 4 Versions non publiées
Red Hat Ansible Automation Platform 2 Versions non publiées
black 24.3 24.3.0 → < 26.3.1 26.3.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Ansible Automation Platform 2.5

Les 33 CVE de Red Hat Ansible Automation Platform 2.5 →
CVE-2026-11807 Eda-server: websocket missing authorization allows credential theft via activation_id spoofing 9.6 Critique CVE-2026-11332 Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution 7.8 Élevée CVE-2026-34993 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python 6.4 Moyenne CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved… 4.1 Moyenne
Suivre cette CVE