Vulnerability PYSEC-2026-2394
Low Risk
LOW RISK
CVSS Score: 2.2
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
3 months ago
July 13, 2026 at 03:46 PM UTC
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
2.0.0 - 2.8.4.7578rc0
2.0.0 - 2.8.4.7578rc0
Summary
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
Details
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
10 hours ago
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
Low Risk
3 months ago
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2391
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2391
Medium Risk
3 months ago
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
2.3.1 - 2.8.4.7578rc0 PYSEC-2026-2392
2.3.1 - 2.8.4.7578rc0 PYSEC-2026-2392
Medium Risk
3 months ago
BBOT: Arbitrary File Write in postman_download Module
2.1.0 - 2.8.5 PYSEC-2026-2393
2.1.0 - 2.8.5 PYSEC-2026-2393
Low Risk
3 months ago
No summary available
2.3.1 - 2.8.6 PYSEC-2026-3719
2.3.1 - 2.8.6 PYSEC-2026-3719
Impacted packages
Timeline
Published
3 months ago
July 13, 2026 at 03:46 PM UTC
Fixed (2.8.5)
4 months ago
June 16, 2026 at 10:58 PM UTC
Last Modified
3 months ago
July 13, 2026 at 04:31 PM UTC