CVE-2026-31900: How a Permissive Regex Led to RCE in psf/black’s GitHub Action

By Tommaso Bona (ParzivalHack), Independent Security Researcher