Quick answers
- Is CVE-2026-14966 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14966 being exploited in the wild.
- How severe is CVE-2026-14966?
- Low severity, with a CVSS score of 3.1, published 8 July 2026.
- Which products and versions are affected?
- bbot (PyPI) >= 2.3.1, < 3.0.0, ECOSYSTEM:introduced=2.3.1,fixed=3.0.0.
- Is there a fix for CVE-2026-14966?
- Yes. bbot (PyPI): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14966 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14966?
- Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- bbot (PyPI): upgrade to 3.0.0 or later
pip install "bbot>=3.0.0"
Technical details
A vulnerability exists in BBOT's `unarchive` module due to improper validation of archive entries in ZIP and 7z formats. While the module intends to reject symbolic links, it fails to account for legacy `p7zip` output where DOS-attribute prefixes precede the Unix mode (e.g., "_ lrwxrwxrwx"). This allows an attacker-controlled symbolic link to bypass the safety check and be written to the extraction directory during a scan. The vulnerability is specifically triggered when BBOT extracts a malicious archive using a host with a legacy `p7zip` build. A fix has been implemented in the project's repository to correctly parse the trailing Unix mode field.
Affected products
- Black Lantern Security BBOT 2.3.1 to 2.8.6
Identifiers
- CVE-2026-14966
- GHSA-xpf3-p7gm-7756
- PYSEC-2026-3719
Timeline
- 2026-07-08: advisory: NVD publication date
- 2026-07-08: disclosed