Black writes a cache file with a filename computed from various formatting options. The --python-cell-magics option's value was included in the filename without sanitization, enabling an attacker who controls this argument to write cache files to arbitrary locations on the filesystem. This improper limitation of pathname to a restricted directory (CWE-22) can lead to arbitrary file write vulnerabilities. The vulnerability is addressed in Black 26.3.1.

An attacker able to control the --python-cell-magics option can write or overwrite files anywhere on the filesystem where the Black process has write permissions. This can lead to integrity violations by modifying or creating critical files, potentially enabling code execution or bypassing security mechanisms. Confidentiality and availability impacts are also possible if sensitive files are overwritten or corrupted. The CVSS v3.1 base score is 8.7 (high severity) with network attack vector, no privileges required, and high integrity impact.

A fix is available in Black version 26.3.1. Users should upgrade to this version to remediate the vulnerability. Until upgrading, avoid allowing untrusted user input in the --python-cell-magics option to prevent exploitation. No other effective mitigations meeting ease of use and applicability criteria are currently available according to the vendor advisory.