Black Lantern Security Bbot
6 CVEs affecting Black Lantern Security Bbot. Latest disclosed: 2026-07-08. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12568 | Medium | 6.5 | 2026-06-17 | The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious works… |
CVE-2026-12565 | Medium | 5.3 | 2026-06-17 | The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of exter… |
CVE-2026-14967 | Low | 3.1 | 2026-07-08 | BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not re… |
CVE-2026-14966 | Low | 3.1 | 2026-07-08 | BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing c… |
CVE-2026-12566 | Low | 3.1 | 2026-06-17 | The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An… |
CVE-2026-12567 | Low | 2.2 | 2026-06-17 | The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing th… |