CVE-2025-10281
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
Risk Assessment
An attacker can obtain a GitHub API key, potentially leading to unauthorized access to repositories and other GitHub resources.
Recommendation
Update BBOT to a patched version. Avoid using the git_clone module with untrusted URLs and regularly rotate API keys.
Other vulnerabilities in BBOT
See all- CVE-2026-14967Low
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory. Its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder.
- CVE-2026-14966Low
The vulnerability in BBOT's unarchive module fails to detect symlinks in zip and 7z archives when their listing carries a DOS-attribute prefix before the unix mode, as produced by legacy p7zip versions. This allows an attacker-controlled symlink to be written into the extraction directory when such an archive is downloaded and extracted during a scan, bypassing the guard.
- CVE-2025-10282Medium
BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
Original NVD description (English source)
BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS