CVE-2026-32274

high Red Hat
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: March 12, 2026
Last Modified: March 12, 2026
Vendor: Red Hat
Source: REDHAT

Description

A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.

CWE

CWE-22

Affected Products

OpenShift LightspeedRed Hat Ansible Automation Platform 2Red Hat Ansible Automation Platform Ansible Core 2Red Hat OpenShift AI (RHOAI)Red Hat OpenShift Virtualization 4

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 github.com