[GHSA-3936-cmfr-pm3m] Black: Arbitrary file writes from unsanitized user input in cache file name

[shaked-seal]

Updates

• Affected products

Comments
Versions before 24.3.0 aren't affected. The unsanitized --python-cell-magics value only reaches the cache filename because of PR #4176 (commit ed770ba4dd50, released in 24.3.0), which hashes the magics into the cache key only when longer than 32 chars. Before 24.3.0, get_cache_key() always sha256-hashed the magics, so no path traversal was possible. Fixed in 26.3.1 (#5038) by restoring unconditional
hashing.

[github]

Hi there @JelleZijlstra! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory