# bbot (PyPI) vulnerabilities

10 known vulnerabilities (2 critical, 4 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/bbot/

## Advisories (10)

### [CVE-2026-14967](https://cve.now/CVE-2026-14967): Path traversal in github\_workflows allows writing artifacts outside output directory

- Severity: Low 3.1
- Published: Jul 8, 2026
- Affected: from 1.1.7, fixed in 3.0.0.

### [CVE-2026-14966](https://cve.now/CVE-2026-14966): Symlink guard bypass in unarchive module allows planting symlinks during extraction

- Severity: Low 3.1
- Published: Jul 8, 2026
- Affected: from 2.3.1, fixed in 3.0.0.

### [CVE-2026-12568](https://cve.now/CVE-2026-12568): Arbitrary File Write in postman\_download module

- Severity: Medium 6.5
- Published: Jun 17, 2026
- Affected: from 2.1.0, fixed in 2.8.6.

### [CVE-2026-12567](https://cve.now/CVE-2026-12567): Symlink-following arbitrary write via github\_workflows module

- Severity: Low 2.2
- Published: Jun 17, 2026
- Affected: from 2.0.0, fixed in 2.8.5.

### [CVE-2026-12566](https://cve.now/CVE-2026-12566): SSRF via unvalidated WWW-Authenticate realm in docker\_pull module

- Severity: Low 3.1
- Published: Jun 17, 2026
- Affected: from 2.0.0, fixed in 2.8.5.

### [CVE-2026-12565](https://cve.now/CVE-2026-12565): Path Traversal (Zip-Slip) in unarchive module

- Severity: Medium 5.3
- Published: Jun 17, 2026
- Affected: from 2.3.1, fixed in 2.8.5.

### [CVE-2025-10284](https://cve.now/CVE-2025-10284): Improper Archive Extraction in unarchive Enables RCE

- Severity: Critical 9.6
- Published: Oct 9, 2025
- Affected: through 2.6.1; fixed in 2.7.0.

### [CVE-2025-10283](https://cve.now/CVE-2025-10283): Improper .git Sanitization in gitdumper Enables RCE

- Severity: Critical 9.6
- Published: Oct 9, 2025
- Affected: through 2.6.1; fixed in 2.7.0.

### [CVE-2025-10282](https://cve.now/CVE-2025-10282): GitLab Domain Confusion in gitlab Leaks API Key

- Severity: Medium 4.7
- Published: Oct 9, 2025
- Affected: through 2.6.1; fixed in 2.7.2; from 2.7.0.6919rc0, fixed in 2.7.2.

### [CVE-2025-10281](https://cve.now/CVE-2025-10281): Insecure URL Handling in git\_clone Leading to Leaked API Key

- Severity: Medium 4.7
- Published: Oct 9, 2025
- Affected: through 2.6.1; fixed in 2.7.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/bbot
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.