BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

CRITICAL 9.6CVE-2025-10283 · GHSA-h6m2-r6h9-4c44 · PYSEC-2026-293 · Published 09/10/2025 · updated 08/10/2026

Package	Affected versions	Patched versions
bbot PyPI	`< 2.7.0`	`2.7.0`

Description

Summary

bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).

bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).

Impact

A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.

NVD description

BBOT's gitdumper module could be abused to execute commands through a malicious git repository.

References

blacklanternsecurity/bbot security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-10283 · ADVISORY
blacklanternsecurity/bbot commit 0ede97f · WEB
blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper · WEB
blacklanternsecurity/bbot · PACKAGE
pypa/advisory-database · WEB
pypi.org/project/bbot · WEB
GitHub Advisory GHSA-h6m2-r6h9-4c44 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free