CVE-2026-12567 is a LOW severity vulnerability in the github_workflows module of Black Lantern Security's BBOT. The module constructs local directory paths from user-controlled repository names without validating for symlinks, allowing a local attacker to plant a symlink at the predictable output path and write workflow data to an attacker-chosen location. This vulnerability has a CVSS score of 2.2 and is [truncated]
CVE-2026-12566 is a vulnerability in the docker_pull module of Black Lantern Security's BBOT tool, allowing an attacker in a man-in-the-middle position to redirect authentication requests to an arbitrary endpoint, potentially leaking authentication tokens. This issue arises from the module's lack of validation for the realm parameter in the WWW-Authenticate response header from a Docker registry. The vuln [truncated]
MEDIUMBlack Lantern SecurityCVE published 2026-06-17
CVE-2026-12565 is a medium-severity path traversal vulnerability in the unarchive internal module's archive extraction commands. The vulnerability allows a malicious archive to write files outside the intended extraction directory on systems with GNU tar < 1.34, such as Ubuntu 20.04, Debian Buster, and CentOS 7. This issue was not fully addressed by CVE-2025-10284, which only fixed git-specific RCE vector [truncated]
