A vulnerability was discovered in the Black GitHub Action with version 26.10.1 and earlier. The issue involved the tool not validating the 'tool.black.required-version' field in pyproject.toml, allowing an attacker to inject malicious code by referencing a direct reference to attacker-controlled code. This could be exploited by submitting a pull request, causing the workflow to install and execute the malicious code in the victim repository's GitHub Actions environment. The vulnerability was fixed in Black version 26.10.1.