Black, the Python code formatter, generates a cache file whose name is constructed from formatting options. Starting with release 24.3.0, the value passed to the --python-cell-magics option was placed directly into that filename without any sanitization. An attacker capable of controlling this argument can therefore cause Black to write a cache file to any path on the filesystem, effectively performing an uncontrolled write (CWE‑22). The potential result is corruption or replacement of arbitrary files, which can compromise system integrity and allow the injection of malicious code into trusted files.

The vulnerability exists in all releases of Black from version 24.3.0 up to, but not including, 26.3.1. The affected product is the Python Software Foundation’s Black code formatter; any installation of Black older than 26.3.1 on any platform is potentially exposed.

The CVSS base score of 8.7 indicates a high impact vulnerability. The EPSS score of < 1 % suggests that exploitation is uncommon at present, and the issue is not listed in the CISA KEV catalog. Likely attack vectors are local or involve through command‑line or configuration manipulation, allowing an adversary to supply a crafted --python-cell-magics value. While remote exploitation is unlikely without privileged access to the Black execution environment, the ability to overwrite files remains a serious risk in contexts where Black is run with elevated privileges.