BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

MEDIO 4.7CVE-2025-10281 · GHSA-63wh-p5fx-h4vc · PYSEC-2026-1216 · Published 09/10/2025 · updated 08/10/2026

En resumen

CVE-2025-10281 es una vulnerabilidad MEDIO (CVSS 4.7) que afecta a bbot.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.23%, mayor que el 13.9% de las vulnerabilidades.
Solución: actualizar a 2.7.0 o posterior.

Package	Affected versions	Patched versions
bbot PyPI	`< 2.7.0`	`2.7.0`

Due to unsafe URL handling, bbot's git_clone.py can be made to leak a user's github.com API key to an attacker-controlled webserver.

A user who has placed their github.com API key in the configuration for any of the following modules:

may leak it to an untrustworthy server.

NVD description

BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 2.7.0

2.7.0

Description

Due to unsafe URL handling, bbot's git_clone.py can be made to leak a user's github.com API key to an attacker-controlled webserver.

A user who has placed their github.com API key in the configuration for any of the following modules:

may leak it to an untrustworthy server.

NVD description

BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.

Más vulnerabilidades de bbot

Ver todo →