BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

심각 9.6CVE-2025-10283 · GHSA-h6m2-r6h9-4c44 · PYSEC-2026-293 · Published 09/10/2025 · updated 08/10/2026

요약

CVE-2025-10283은(는) bbot에 영향을 주는 심각 (CVSS 9.6) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.48%, 전체 취약점의 41.6%보다 높음.
조치: 2.7.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
bbot PyPI	`< 2.7.0`	`2.7.0`

Description

Summary

bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).

bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).

Impact

A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.

NVD description

BBOT's gitdumper module could be abused to execute commands through a malicious git repository.

References

blacklanternsecurity/bbot security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-10283 · ADVISORY
blacklanternsecurity/bbot commit 0ede97f · WEB
blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper · WEB
blacklanternsecurity/bbot · PACKAGE
pypa/advisory-database · WEB
pypi.org/project/bbot · WEB
GitHub Advisory GHSA-h6m2-r6h9-4c44 · ADVISORY

bbot의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

bbot

PyPI

< 2.7.0

2.7.0

Description

Summary

bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).

bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).

Impact

A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.

NVD description

BBOT's gitdumper module could be abused to execute commands through a malicious git repository.

bbot의 다른 취약점

모두 보기 →