{"id":"CVE-2025-10283","kind":"vulnerability","aliases":["CVE-2025-10283","GHSA-h6m2-r6h9-4c44"],"related":[],"title":"BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE","description":"### Summary\n\nbbot's `gitdumper.py` insufficiently sanitises a `.git/config` file, leading to Remote Code Execution (RCE).\n\nbbot's `gitdumper.py` can be made to consume a malicious `.git/index` file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).\n\n### Impact\n\nA user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.","summary":"BBOT's gitdumper module does not sanitize data from a scanned target's .git files, including a malicious .git/index that causes arbitrary file writes. A malicious web server being scanned can use this to get code executed on the machine running BBOT.","severity":"critical","cvss":9.6,"epss":0.00483,"exploited":false,"exploited_at":null,"products":[{"name":"bbot","fixed":["2.7.0"],"affected":"< 2.7.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["bbot","cwe-22","package","pypi","python","security-scanning"],"not_affected_if":["bbot-below-2.7.0-not-installed","gitdumper-module-disabled"],"how_to_check":"- Check the installed version with `pip show bbot` and compare it to `2.7.0`\n- Check whether the gitdumper module is enabled in scan configs, since it is the vulnerable code path","fix":"- Upgrade `bbot` to `2.7.0` or later with `pip install -U bbot>=2.7.0`","status":"open","published_at":"2025-10-09T16:15:43+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","triaged_at":"2026-10-27T15:19:04+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T15:19:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `bbot` to `2.7.0` or later with `pip install -U bbot>=2.7.0`","reach":"internet","title":"BBOT: gitdumper path traversal lets scanned servers run code","impact":"high","summary":"BBOT's gitdumper module does not sanitize data from a scanned target's .git files, including a malicious .git/index that causes arbitrary file writes. A malicious web server being scanned can use this to get code executed on the machine running BBOT.","category":"package","nicknames":[],"who_cares":["python","pypi","bbot","security-scanning"],"confidence":0.8,"needs_auth":"no","worst_case":"Code runs on the machine running the BBOT scan","analyst_note":"","how_to_check":"- Check the installed version with `pip show bbot` and compare it to `2.7.0`\n- Check whether the gitdumper module is enabled in scan configs, since it is the vulnerable code path","needs_analyst":false,"not_affected_if":["bbot-below-2.7.0-not-installed","gitdumper-module-disabled"],"who_is_affected":"Teams that run BBOT against external or untrusted hosts, because the flaw is triggered by content the scanned server returns, which the gitdumper module downloads and parses. Teams that only scan their own known-good assets or do not use BBOT can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000592,"input_tokens":3420,"output_tokens":501,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10283':14A,22A '-2025':13A,21A '-22':26B '4c44':19A 'achiev':112C 'arbitrari':54B,104C,130C 'bbot':1A,23A,24B,33B,74B,76C,90C,122C 'caus':53B 'code':68B,87C,114C,131C 'consum':97C 'cve':12A,20A 'cwe':25B 'data':40B 'execut':69B,88C,115C,132C 'file':47B,55B,83C,101C,105C 'get':67B 'ghsa':16A 'ghsa-h6m2-r6h9-4c44':15A 'git':46B 'git/config':82C 'git/index':51B,100C 'gitdump':35B 'gitdumper.py':7A,78C,92C 'h6m2':17A 'impact':117C 'includ':48B 'insuffici':3A,79C 'issu':5A 'lead':9A,84C,102C 'machin':72B 'made':95C 'malici':50B,58B,99C,126C 'may':128C 'modul':36B 'packag':27B 'pypi':28B 'python':29B 'r6h9':18A 'rce':11A,89C,116C 'remot':86C,113C 'run':73B 'sanit':4A,39B 'sanitis':80C 'scan':32B,43B,62B,124C 'secur':31B 'security-scan':30B 'server':60B 'summari':75C 'system':135C 'target':44B 'use':64B,110C,121C 'user':119C 'web':59B 'webserv':127C 'write':56B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams that run BBOT against external or untrusted hosts, because the flaw is triggered by content the scanned server returns, which the gitdumper module downloads and parses. Teams that only scan their own known-good assets or do not use BBOT can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-10-09T16:15:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h6m2-r6h9-4c44","url":"https://github.com/advisories/GHSA-h6m2-r6h9-4c44","severity":"critical","published_at":"2025-10-09T22:29:46+00:00","modified_at":"2026-10-27T15:16:55+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","fetched_at":"2026-10-27T15:18:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-10283","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10283","severity":null,"published_at":"2025-10-09T16:15:43+00:00","modified_at":"2026-10-08T13:10:00+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}