BBOT's various issues in unarchive.py can cause arbitrary file write and RCE

概要

参考情報

• blacklanternsecurity/bbot security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-10284 · ADVISORY
• blacklanternsecurity/bbot commit 6325f2f · WEB
• blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper · WEB
• blacklanternsecurity/bbot · PACKAGE
• pypa/advisory-database · WEB
• pypi.org/project/bbot · WEB
• GitHub Advisory GHSA-fhw8-8v9p-7jp7 · ADVISORY

bbot のその他の脆弱性

• CVE-2026-14967低 3.1BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containme…
• CVE-2026-14966低 3.1BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symli…
• CVE-2026-12568中 6.5The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. I…
• CVE-2026-12567低 2.2The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local …
• CVE-2026-12566低 3.1The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint wit…