Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory.

Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.