CVE-2025-10281: BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.

CVE-2025-10281 · Severity: medium · CVSS 4.7 · Published 2025-10-09

BBOT, a recursive OSINT (Open Source Intelligence) framework, contains a vulnerability that can leak a user's GitHub API keys to an unauthorized third party. If a user interacts with a malicious server while using certain BBOT modules, their private credentials could be captured by an attacker. This could allow an attacker to access the user's GitHub account and private data.

Technologies: bbot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-10281 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-10281 being exploited in the wild.
How severe is CVE-2025-10281?
Medium severity, with a CVSS score of 4.7, published 9 October 2025.
Which products and versions are affected?
bbot (PyPI) < 2.7.0, ECOSYSTEM:introduced=0,fixed=2.7.0.
Is there a fix for CVE-2025-10281?
Yes. bbot (PyPI): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-10281 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-10281?
Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • bbot (PyPI): upgrade to 2.7.0 or later
    pip install "bbot>=2.7.0"

Technical details

An information disclosure vulnerability exists in BBOT's `git_clone.py` module due to unsafe URL handling. When a user has configured GitHub API keys for modules such as `github_codesearch`, `github_workflows`, or `git_clone`, the application may inadvertently include these credentials in requests sent to untrusted, attacker-controlled webservers. The vulnerability is triggered when the tool interacts with a malicious URL, requiring some level of user interaction (e.g., scanning a malicious target). This can result in the full compromise of the user's GitHub API credentials. The issue is addressed in version 2.7.0.

Affected products

  • Black Lantern Security bbot < 2.7.0

Identifiers

  • CVE-2025-10281
  • GHSA-63wh-p5fx-h4vc
  • PYSEC-2026-1216

Timeline

  • 2025-10-09: disclosed
  • 2025-10-09: advisory
  • 2025-10-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.