Live › vulnerability › CVE-2025-10283
Go to dashboardBBOT's gitdumper module does not sanitize data from a scanned target's .git files, including a malicious .git/index that causes arbitrary file writes. A malicious web server being scanned can use this to get code executed on the machine running BBOT.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:18 UTC, 0h before NVD. All times on this page are UTC.
Teams that run BBOT against external or untrusted hosts, because the flaw is triggered by content the scanned server returns, which the gitdumper module downloads and parses. Teams that only scan their own known-good assets or do not use BBOT can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| bbot | pypi | < 2.7.0 | 2.7.0 |
pip show bbot and compare it to 2.7.0bbot to 2.7.0 or later with pip install -U bbot>=2.7.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).
bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
This page as .md · .json · in your agent: get_signal("CVE-2025-10283")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.