Vulnerability · Published Jun 17, 2026 · Assigned by BLSOPS
CVE-2026-12567Symlink-following arbitrary write via github_workflows module
Low 2.2
In plain English
A low-severity security flaw in BBOT from Black Lantern Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.2Low
Exploit odds (30 days)<0.1%top 99.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | bbot | 2.8.5 | GHSA-rvp7-w75q-9fv2 |
| PyPI | bbot | 2.8.5 | PYSEC-2026-2394 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Black Lantern Security | BBOT | 2.0.0 – through <=2.8.4 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N