BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

MEDIUM 4.7CVE-2025-10281 · GHSA-63wh-p5fx-h4vc · PYSEC-2026-1216 · Published 09/10/2025 · updated 08/10/2026

Package	Affected versions	Patched versions
bbot PyPI	`< 2.7.0`	`2.7.0`

Description

Due to unsafe URL handling, bbot's git_clone.py can be made to leak a user's github.com API key to an attacker-controlled webserver.

A user who has placed their github.com API key in the configuration for any of the following modules:

may leak it to an untrustworthy server.

NVD description

BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.