The BBOT `github_workflows` module is vulnerable to a path traversal attack, allowing an attacker to write a downloaded artifact outside its configured output directory. This vulnerability is due to the path-containment check not resolving `..`. Operators of BBOT, especially those using the `github_workflows` module, should be aware of this vulnerability and take steps to mitigate it. The write is bounded [truncated]
CVE-2026-12567 is a LOW severity vulnerability in the github_workflows module of Black Lantern Security's BBOT. The module constructs local directory paths from user-controlled repository names without validating for symlinks, allowing a local attacker to plant a symlink at the predictable output path and write workflow data to an attacker-chosen location. This vulnerability has a CVSS score of 2.2 and is [truncated]
CVE-2026-12566 is a vulnerability in the docker_pull module of Black Lantern Security's BBOT tool, allowing an attacker in a man-in-the-middle position to redirect authentication requests to an arbitrary endpoint, potentially leaking authentication tokens. This issue arises from the module's lack of validation for the realm parameter in the WWW-Authenticate response header from a Docker registry. The vuln [truncated]
MEDIUMBlack Lantern SecurityCVE published 2026-06-17
CVE-2026-12565 is a medium-severity path traversal vulnerability in the unarchive internal module's archive extraction commands. The vulnerability allows a malicious archive to write files outside the intended extraction directory on systems with GNU tar < 1.34, such as Ubuntu 20.04, Debian Buster, and CentOS 7. This issue was not fully addressed by CVE-2025-10284, which only fixed git-specific RCE vector [truncated]
