Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with     use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is     a released Black version specifier. An attacker who can submit a pull request can change that field to a     direct reference to attacker-controlled code, causing the workflow to install and execute the code in the     victim repository's GitHub Actions context. This issue is fixed in version 26.10.1. (CVE-2026-114134)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with
    use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is
    a released Black version specifier. An attacker who can submit a pull request can change that field to a
    direct reference to attacker-controlled code, causing the workflow to install and execute the code in the
    victim repository's GitHub Actions context. This issue is fixed in version 26.10.1. (CVE-2026-114134)

ID	Name	Product	Family	Type	Severity
377538	Linux Distros Unpatched Vulnerability : CVE-2026-114134	Nessus	Misc.	Local	high
477162	Chainguard: nemo: security update to 2.7.3-r39	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477162	Chainguard: nemo: security update to 2.7.3-r39	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
476829	SCA: security update for black (GHSA-cg8m-r9f2-5wm2)	Tenable Cloud Security	SCA Checks	Local	high
476829	SCA: security update for black (GHSA-cg8m-r9f2-5wm2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-114134

high

Tenable Plugins

high

high

high

high

high