CVE-2026-32274

CVE-2026-32274 is a path traversal vulnerability affecting the Python code formatter Black, specifically versions prior to 26.3.1. It allows an attacker to write cache files to arbitrary file system locations by injecting unsanitized input into the --python-cell-magics option. Rated High with a CVSS v3.1 score of 7.5, this vulnerability has a low attack complexity and can be exploited remotely without authentication or user interaction, leading to a high integrity impact. There is currently no evidence of active exploitation, nor are there public exploit modules available. Despite some community discussion and limited media coverage, its very low EPSS score suggests a minimal likelihood of exploitation in the wild.