CVE-2025-10281: Black Lantern Security BBOT information disclosure in git_clone.py

Executive brief

BBOT, a recursive OSINT (Open Source Intelligence) framework, contains a vulnerability that can leak a user's GitHub API keys to an unauthorized third party. If a user interacts with a malicious server while using certain BBOT modules, their private credentials could be captured by an attacker. This could allow an attacker to access the user's GitHub account and private data.

Technical details

An information disclosure vulnerability exists in BBOT's `git_clone.py` module due to unsafe URL handling. When a user has configured GitHub API keys for modules such as `github_codesearch`, `github_workflows`, or `git_clone`, the application may inadvertently include these credentials in requests sent to untrusted, attacker-controlled webservers. The vulnerability is triggered when the tool interacts with a malicious URL, requiring some level of user interaction (e.g., scanning a malicious target). This can result in the full compromise of the user's GitHub API credentials. The issue is addressed in version 2.7.0.

Affected products

• Black Lantern Security bbot < 2.7.0

Timeline

• 2025-10-09: disclosed
• 2025-10-09: advisory
• 2025-10-09: patched

References

• https://api.github.com/users/justinsteven
• https://github.com/justinsteven
• https://api.github.com/users/justinsteven/gists%7B/gist_id%7D
• https://api.github.com/users/justinsteven/repos
• https://avatars.githubusercontent.com/u/1893909?v=4
• https://api.github.com/users/justinsteven/events%7B/privacy%7D