blacklanternsecurity/bbot · Security
BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
- GHSA ID
- GHSA-63wh-p5fx-h4vc
- CVE ID
- CVE-2025-10281
- Severity
- medium
- Published
- Updated
- CVSS
- 4.7 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
- CVSS v3
- 4.7 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Description
Summary
Due to unsafe URL handling, bbot's git_clone.py can be made to leak a user's github.com API key to an attacker-controlled webserver.
Impact
A user who has placed their github.com API key in the configuration for any of the following modules:
github_codesearchgithub_workflowsgitlabgit_clonegithub_usersearchgithub_org
may leak it to an untrustworthy server.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
References
- https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-63wh-p5fx-h4vc ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-10281 ↗
- https://github.com/blacklanternsecurity/bbot/commit/0ede97fa887de33fcfd1378b4213a09c21dc6140 ↗
- https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper ↗
- https://github.com/advisories/GHSA-63wh-p5fx-h4vc ↗