Vulnerability Database

296,676

Total vulnerabilities in the database

CVE-2025-10281

Summary

Due to unsafe URL handling, bbot's git_clone.py can be made to leak a user's github.com API key to an attacker-controlled webserver.

Impact

A user who has placed their github.com API key in the configuration for any of the following modules:

github_codesearch
github_workflows
gitlab
git_clone
github_usersearch
github_org

may leak it to an untrustworthy server.

Published: Oct 9, 2025
Updated: Oct 10, 2025
CVE: CVE-2025-10281
GHSA: GHSA-63wh-p5fx-h4vc
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CWEs:

CWE-200

Affected Software
References

Software	From	Fixed in
bbot	-	2.7.0

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime