~ / search / GHSA-p3v4-c93g-cmhw

GHSA-p3v4-c93g-cmhw

BBOT's gitlab.py exposes globally configured "gitlab" API key

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-10282

Packages

EcosystemPackageAffectedFixed in
PyPI bbot < 2.7.2 2.7.2
PyPI bbot >= 2.7.0.6919rc0, < 2.7.2 2.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary bbot's `gitlab.py` sends the user's "gitlab" API key to on-premise GitLab instances. If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server. ### Impact A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.

References

External links from the advisory. They lead to third-party sites.