Black, a Python code formatter, prior to version 26.3.1, improperly handled the --python-cell-magics option by incorporating its value directly into cache file names without sanitization. This allowed an attacker who can control this option to perform path traversal and write cache files to arbitrary locations on the filesystem. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The issue is fixed in Black 26.3.1. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity.

An attacker able to control the --python-cell-magics option can write cache files to arbitrary filesystem locations, potentially overwriting or creating files outside the intended cache directory. This could lead to unauthorized file modification or code execution depending on the environment and usage context. The vulnerability affects system integrity but does not require privileges or user interaction to exploit.

Upgrade Black to version 26.3.1 or later, where this vulnerability is fixed. There are no vendor advisories indicating alternative mitigations or that no action is required. Patch status is confirmed fixed in 26.3.1.