There are 2 open security issues in bookworm.
1 issue left for the package maintainer to handle:
- CVE-2026-32274:
(needs triaging)
Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.
You can find information about how to handle this issue in the security team's documentation.
1 ignored issue:
- CVE-2024-21503:
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/b/black.png){kind=link}