N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-v53h-f6m7-xcgm

GHSA-v53h-f6m7-xcgm: Black's vulnerable version parsing leads to RCE in GitHub Action

Impact

Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action.

Patches

Version 26.3.0 fixes this vulnerability by tightening the validation of the version field. Users who use the GitHub Action as psf/black@stable will automatically pick up this update.

Workarounds

Do not use the use_pyproject: true option in the psf/black GitHub Action.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-v53h-f6m7-xcgm

GHSA-v53h-f6m7-xcgm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
psf/black	actions	< 26.3.0	26.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the psf/black GitHub Action, where improper input validation of the pyproject.toml file can lead to remote code execution. The patch, found in commit 0a2560b981364dde4c8cf8ce9d164c40669a8611, addresses this by strengthening a regular expression in action/main.py. My analysis of this patch identified that the BLACK_VERSION_RE was overly permissive, allowing for the injection of direct URL references. The function get_black_version_from_pyproject in action/main.py utilizes this regex to parse the version from the pyproject.toml file. Consequently, this function is the focal point of the vulnerability. An attacker could exploit this by crafting a malicious pyproject.toml file, which, when processed by the action, would lead to the execution of arbitrary code within the GitHub Action's execution environment.

Vulnerable functions

get_black_version_from_pyproject

action/main.py

This function parses the `pyproject.toml` file to find the version of the `black` package to use. It uses a regular expression, `BLACK_VERSION_RE`, to match and extract the version. The original regex was too permissive and would incorrectly parse a direct URL reference as a valid version. A malicious actor could provide a `pyproject.toml` file in a pull request that specifies a URL to a malicious package (e.g., `black @ https://example.com/malicious-package`). This function would fail to properly validate the input, and the malicious URL would be passed to the package installer, resulting in remote code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.