GHSA-63wh-p5fx-h4vcMediumCVSS 4.7

BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

Published
October 9, 2025
Last Modified
June 15, 2026

🔗 CVE IDs covered (1)

CVE-2025-10281 →

📋 Description

Summary

Due to unsafe URL handling, bbot's git_clone.py can be made to leak a user's github.com API key to an attacker-controlled webserver.

Impact

A user who has placed their github.com API key in the configuration for any of the following modules:

  • github_codesearch
  • github_workflows
  • gitlab
  • git_clone
  • github_usersearch
  • github_org

may leak it to an untrustworthy server.

🎯 Affected products1

  • pip/bbot:< 2.7.0

🔗 References (5)