CVE-2025-10283
Improper .git Sanitization in gitdumper Enables RCE
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper .git Sanitization in gitdumper Enables RCE
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
- Record
CVE-2025-10283- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2025-33394
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
- Record
EUVD-2025-33394- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h6m2-r6h9-4c44
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
Summary
bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).
bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).
Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
- Record
GHSA-h6m2-r6h9-4c44- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
- Record
CVE-2025-10283- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-h6m2-r6h9-4c44
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
Summary
bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).
bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).
Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
- Record
GHSA-h6m2-r6h9-4c44- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-293
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
Summary
bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution (RCE).
bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution (RCE).
Impact
A user who uses bbot to scan a malicious webserver may have arbitrary code executed on their system.
- Record
PYSEC-2026-293- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bbotPyPI |
before 2.7.0 | 2.7.0 |
bbotPyPI |
before 2.7.0, plus listed versions 1.0.01.0.11.0.21.0.31.0.3.512 Show 45 moreShow less1.0.3.5211.0.3.5451.0.3.5831.0.3.6961.0.3.7771.0.3.7801.0.3.9191.0.4.1132rc01.0.4.1134rc01.0.4.1139rc01.0.4.1141rc01.0.4.1147rc01.0.4.1156rc01.0.4.1158rc01.0.4.1160rc01.0.4.1162rc01.0.4.1164rc01.0.4.1166rc01.0.4.1168rc01.0.4.1170rc01.0.4.1173rc01.0.4.1175rc01.0.4.1177rc01.0.4.1183rc01.0.4.1185rc01.0.4.1193rc01.0.4.1197rc01.0.4.1199rc01.0.4.1233rc01.0.4.1235rc01.0.4.1237rc01.0.4.1242rc01.0.4.1262rc01.0.4.1266rc01.0.4.1269rc01.0.4.1272rc01.0.4.1276rc01.0.4.1279rc01.0.4.1285rc01.0.4.1303rc01.0.4.1306rc01.0.4.1310rc01.0.4.9221.0.5.1313rc01.0.5.1317rc0 |
2.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-10283 is a critical vulnerability (CVSS 9.6) in Blsops, Llc Bbot, published October 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in bbot 2.7.0.
References
blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper
github.com/blacklanternsecurity/bbot/security/advisories/GHSA-h6m2-r6h9-4c44
nvd.nist.gov/vuln/detail/CVE-2025-10283
pypi.org/project/bbot
Left out here: 575 versions. The JSON record has them.