bbot has 10 CVEs on record between 2025 and 2026. Disclosures have slowed: 0 in the last 90 days after 6 in the 90 before. The busiest recent month was June 2026 with 4. The median CVSS is 4.7 (medium), with 2 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-22 (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.7
- Publish → KEV
- —
- Last 90 days
- 0 prev 6
Worst active — by depth score
CVE-2025-10284Critical· 9.6BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.53CVE-2025-10283Critical· 9.6BBOT's gitdumper module could be abused to execute commands through a malicious git repository.53CVE-2026-12568Medium· 6.5BBOT: Arbitrary File Write in postman_download Module36CVE-2026-12565Medium· 5.3BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-1028429CVE-2025-10282Medium· 4.7BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.26
bbot vulnerabilities
CVEs affecting bbot, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-14967Low· 3.1BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-contai…
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the inten…
CVE-2026-14966Low· 3.1BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect sy…
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy vers…
CVE-2026-12566Low· 3.1BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
CVE-2026-12565Medium· 5.3BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
CVE-2026-12568Medium· 6.5BBOT: Arbitrary File Write in postman_download Module
BBOT: Arbitrary File Write in postman_download Module
CVE-2026-12567Low· 2.2BBOT: Symlink-Following Arbitrary Write via github_workflows Module
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
CVE-2025-10284Critical· 9.6BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
CVE-2025-10283Critical· 9.6BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
CVE-2025-10282Medium· 4.7BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
CVE-2025-10281Medium· 4.7BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.