BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

Mô tả

Tham khảo

• blacklanternsecurity/bbot security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-10281 · ADVISORY
• blacklanternsecurity/bbot commit 0ede97f · WEB
• blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper · WEB
• blacklanternsecurity/bbot · PACKAGE
• pypi.org/project/bbot · PACKAGE
• GitHub Advisory GHSA-63wh-p5fx-h4vc · ADVISORY

Lỗ hổng khác của bbot

• CVE-2026-14967THẤP 3.1BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containme…
• CVE-2026-14966THẤP 3.1BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symli…
• CVE-2026-12568TRUNG BÌNH 6.5The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. I…
• CVE-2026-12567THẤP 2.2The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local …
• CVE-2026-12566THẤP 3.1The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint wit…