Skip to content
OpenAdvisories

Package · PyPI

bbot

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-12568

    Arbitrary File Write in postman_download module

    The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended…

    Black Lantern Security BBOT bbot PyPI
  • Medium 5.3
    CVE-2026-12565

    Path Traversal (Zip-Slip) in unarchive module

    The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE v…

    Black Lantern Security BBOT bbot PyPI
  • Medium 4.7
    CVE-2025-10282

    GitLab Domain Confusion in gitlab Leaks API Key

    BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

    BLSOPS bbot bbot PyPI
  • Medium 4.7
    CVE-2025-10281

    Insecure URL Handling in git_clone Leading to Leaked API Key

    BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.

    BLSOPS bbot bbot PyPI