Is CVE-2026-14967 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14967 being exploited in the wild.

How severe is CVE-2026-14967?

Low severity, with a CVSS score of 3.1, published 8 July 2026.

Which products and versions are affected?

bbot (PyPI) ECOSYSTEM:introduced=1.1.7,fixed=3.0.0.

Is there a fix for CVE-2026-14967?

Yes. bbot (PyPI): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14967 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14967?

Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14967: Black Lantern Security BBOT path traversal in github_workflows module

CVE-2026-14967 · Severity: low · CVSS 3.1 · Published 2026-07-08

BBOT, an OSINT automation framework, contains a flaw in its GitHub Workflows module that could allow files to be saved in unintended locations on the operator's system. By providing a specially crafted repository URL, an attacker could trick the tool into writing downloaded data up to two directory levels outside of the designated output folder. While the attacker cannot choose the specific file name or destination—which are determined by the user's configuration—this could lead to minor data integrity issues or organizational clutter.

Technologies: bbot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-14967 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14967 being exploited in the wild.
How severe is CVE-2026-14967?: Low severity, with a CVSS score of 3.1, published 8 July 2026.
Which products and versions are affected?: bbot (PyPI) ECOSYSTEM:introduced=1.1.7,fixed=3.0.0.
Is there a fix for CVE-2026-14967?: Yes. bbot (PyPI): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14967 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14967?: Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bbot (PyPI): upgrade to 3.0.0 or later
```
pip install "bbot>=3.0.0"
```

Technical details

A path traversal vulnerability (CWE-22) exists in the `github_workflows` module of BBOT due to insufficient validation of the `CODE_REPOSITORY` URL. The path-containment check failed to resolve dot-dot (`..`) sequences before validation, allowing a crafted URL to escape the intended output directory. The exploit is limited to two directory levels above the configured output location, and the final target path is determined by the operator's configuration rather than direct attacker input. This requires the operator to interact with a malicious repository URL. The issue was addressed in a commit that ensures paths are resolved and filenames are sanitized before writing to disk.

Affected products

Black Lantern Security BBOT 1.1.7 to 2.8.6

Identifiers

CVE-2026-14967
PYSEC-2026-3720

Timeline

2026-07-08: advisory: NVD publication date
2026-07-08: disclosed: Vulnerability details published by Black Lantern Security

References

https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.