~ / search / GHSA-rvp7-w75q-9fv2

GHSA-rvp7-w75q-9fv2

BBOT: Symlink-Following Arbitrary Write via github_workflows Module

Source: GitHub Advisory Database (reviewed) Low CVE-2026-12567

Packages

EcosystemPackageAffectedFixed in
PyPI bbot >= 2.0.0, < 2.8.5 2.8.5

Details

As written in the advisory (Markdown source, shown as plain text).

The `github_workflows` module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.

References

External links from the advisory. They lead to third-party sites.