BBOT's gitlab.py exposes globally configured "gitlab" API key

MEDIUM 4.7CVE-2025-10282 · GHSA-p3v4-c93g-cmhw · PYSEC-2026-1217 · Published 09/10/2025 · updated 08/10/2026

Package	Affected versions	Patched versions
bbot PyPI	`≥ 2.7.0.6919rc0, < 2.7.2< 2.7.2`	`2.7.2`

Description

bbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.

NVD description

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.