black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl: 1 vulnerabilities (highest severity is: 5.3) #5
Description
Vulnerable Library - black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
The uncompromising code formatter.
Path to dependency file: /dev/requirements.txt
Path to vulnerable library: /tmp/ws-ua_20250911162230_THIROO/python_WJUNOV/202509111623321/env/lib/python3.9/site-packages/black-23.12.1.dist-info,/tmp/ws-ua_20250911162230_THIROO/python_WJUNOV/20250911162252/black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Found in HEAD commit: eb4a123ac71f425039cbf2b066115e480b3e6cc6
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (black version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-21503 |  Medium |
5.3 | black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Direct | N/A | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-21503
Vulnerable Library - black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
The uncompromising code formatter.
Path to dependency file: /dev/requirements.txt
Path to vulnerable library: /tmp/ws-ua_20250911162230_THIROO/python_WJUNOV/202509111623321/env/lib/python3.9/site-packages/black-23.12.1.dist-info,/tmp/ws-ua_20250911162230_THIROO/python_WJUNOV/20250911162252/black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Dependency Hierarchy:
- ❌ black-23.12.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library)
Found in HEAD commit: eb4a123ac71f425039cbf2b066115e480b3e6cc6
Found in base branch: master
Vulnerability Details
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Publish Date: 2024-03-19
URL: CVE-2024-21503
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low