- Latest release
- 26.10.1 (Oct 10, 2026): no advisory affects it
- Newest unaffected release
- 26.10.1 (Oct 10, 2026), the latest release
- Advisories
- 4 · 3 high, 1 medium
- Weekly downloads
- 27.9M
- Dependents
- 2,581
- Releases
- 75 since 22.1.0 (Jan 29, 2022)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-114134Affects 18.3.0a0 to 26.10.0 (26.10.1 is outside it)
- CVE-2026-32274Affects 18.3.0a0 to 26.3.0 (26.3.1 is outside it)
- CVE-2026-31900Affects 18.3.0a0 to 26.1.0 (26.3.0 is outside it)
- CVE-2024-21503Affects 18.3.0a0 to 24.2.0 (24.3.0 is outside it)
Advisories 4
- CVE-2026-114134High 8.7
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Affected: fixed in 26.10.1.
Fixed in 26.10.1 (released Oct 10, 2026, 26 days before disclosure).
The latest release, 26.10.1, is not affected.
- CVE-2026-32274High 8.7
Black: Arbitrary file writes from unsanitized user input in cache file name
Affected: fixed in 26.3.1; from 24.3.0, fixed in 26.3.1.
Fixed in 26.3.1 (released Mar 12, 2026, the day of disclosure).
The latest release, 26.10.1, is not affected.
- CVE-2026-31900High 8.7
Black's vulnerable version parsing leads to RCE in GitHub Action
Affected: fixed in 26.3.0.
Fixed in 26.3.0 (released Mar 6, 2026, 5 days before disclosure).
The latest release, 26.10.1, is not affected.
- CVE-2024-21503Medium 5.3
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the…
Affected: fixed in 24.3.0.
Fixed in 24.3.0 (released Mar 15, 2024, 4 days before disclosure).
The latest release, 26.10.1, is not affected.