# CVE-2025-10283: BBOT's gitdumper module could be abused to execute commands through a malicious git repository.

Source: https://junglewise.ai/threats/cve-2025-10283-bbot-s-insufficient-sanitization-issues-in-gitdumper-py-can-lead  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-09  
License: CC BY 4.0 with a link back

CVE-2025-10283 · Severity: critical · CVSS 9.6 · Published 2025-10-09

BBOT's gitdumper module could be abused to execute commands through a malicious git repository.

Technologies: [bbot (PyPI)](https://junglewise.ai/threats/technologies/bbot). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-10283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-10283 being exploited in the wild.

**How severe is CVE-2025-10283?** Critical severity, with a CVSS score of 9.6, published 9 October 2025.

**Which products and versions are affected?** bbot (PyPI) < 2.7.0, ECOSYSTEM:introduced=0,fixed=2.7.0.

**Is there a fix for CVE-2025-10283?** Yes. bbot (PyPI): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-10283?** Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bbot (PyPI): upgrade to 2.7.0 or later

  ```sh
  pip install "bbot>=2.7.0"
  ```


## Affected products

- bbot (PyPI) < 2.7.0, ECOSYSTEM:introduced=0,fixed=2.7.0

## Identifiers

- CVE-2025-10283
- GHSA-h6m2-r6h9-4c44
- PYSEC-2026-293

## Related threats

- [Black Lantern Security BBOT path traversal in github_workflows module](https://junglewise.ai/threats/cve-2026-14967-black-lantern-security-bbot-path-traversal-in-github-workflows)
- [Black Lantern Security BBOT symbolic link bypass in unarchive module](https://junglewise.ai/threats/cve-2026-14966-black-lantern-security-bbot-symbolic-link-bypass-in-unarchive)
- [Black Lantern Security BBOT path traversal in postman_download module](https://junglewise.ai/threats/cve-2026-12568-black-lantern-security-bbot-path-traversal-in-postman-download)
- [Black Lantern Security BBOT symlink following in github_workflows](https://junglewise.ai/threats/cve-2026-12567-black-lantern-security-bbot-symlink-following-in-github-workflows)
- [Black Lantern Security BBOT SSRF in docker_pull module](https://junglewise.ai/threats/cve-2026-12566-black-lantern-security-bbot-ssrf-in-docker-pull-module)