GitHub Advisoryadvisory · PyPI

GHSA-rvp7-w75q-9fv2 BBOT: Symlink-Following Arbitrary Write via github_workflows Module

LOW Published 2026-06-18 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-12567
Ecosystem
PyPI
Packages
bbot
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-22, CWE-59
Reviewed
2026-06-18

Affected packages

• PyPI bbot: >= 2.0.0, < 2.8.5 → fixed in 2.8.5

Description

The `github_workflows` module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.

Related

Alias · CVE (1)

  • CVE-2026-12567 The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References