# CVE-2025-10282: BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Source: https://junglewise.ai/threats/cve-2025-10282-bbot-s-gitlab-py-exposes-globally-configured-gitlab-api-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-09  
License: CC BY 4.0 with a link back

CVE-2025-10282 · Severity: medium · CVSS 4.7 · Published 2025-10-09

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Technologies: [bbot (PyPI)](https://junglewise.ai/threats/technologies/bbot). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-10282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-10282 being exploited in the wild.

**How severe is CVE-2025-10282?** Medium severity, with a CVSS score of 4.7, published 9 October 2025.

**Which products and versions are affected?** bbot (PyPI) ECOSYSTEM:introduced=0,fixed=2.7.2.

**Is there a fix for CVE-2025-10282?** Yes. bbot (PyPI): upgrade to 2.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-10282?** Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bbot (PyPI): upgrade to 2.7.2 or later

  ```sh
  pip install "bbot>=2.7.2"
  ```


## Affected products

- bbot (PyPI) ECOSYSTEM:introduced=0,fixed=2.7.2

## Identifiers

- CVE-2025-10282
- GHSA-p3v4-c93g-cmhw
- PYSEC-2026-1217

## Related threats

- [Black Lantern Security BBOT path traversal in github_workflows module](https://junglewise.ai/threats/cve-2026-14967-black-lantern-security-bbot-path-traversal-in-github-workflows)
- [Black Lantern Security BBOT symbolic link bypass in unarchive module](https://junglewise.ai/threats/cve-2026-14966-black-lantern-security-bbot-symbolic-link-bypass-in-unarchive)
- [Black Lantern Security BBOT path traversal in postman_download module](https://junglewise.ai/threats/cve-2026-12568-black-lantern-security-bbot-path-traversal-in-postman-download)
- [Black Lantern Security BBOT symlink following in github_workflows](https://junglewise.ai/threats/cve-2026-12567-black-lantern-security-bbot-symlink-following-in-github-workflows)
- [Black Lantern Security BBOT SSRF in docker_pull module](https://junglewise.ai/threats/cve-2026-12566-black-lantern-security-bbot-ssrf-in-docker-pull-module)