Black, a popular Python code formatter, generates a cache file whose name incorporates the value of the --python-cell-magics option. Before version 26.3.1, this option was added to the filename without sanitization, allowing an attacker who can control the option value to write cache files to arbitrary filesystem locations. This vulnerability is a classic example of an operating‑system path traversal leading to arbitrary file writes (CWE‑22). The attacker could overwrite critical files, inject malicious code, or otherwise compromise the integrity of the systems where Black is executed.

Vendors affected are Python Software Foundation (psf) Black. The issue exists in all releases of Black older than 26.3.1. Users running any such version on any platform are potentially exposed.

The vulnerability carries a high CVSS base score of 8.7, indicating significant impact. The EPSS score is < 1 %, suggesting exploitation is currently rare, and it is not listed in the CISA KEV catalog. Likely attack vectors are local or in contexts where an attacker can influence the command‑line arguments or configuration of Black, enabling them to supply a specially crafted --python-cell-magics value. While not immediately exploitable remotely, the potential for file overwrite makes it a serious risk in environments where Black runs with elevated privileges.