low2.2
CVE-2026-12567
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks.
Impact
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | bbot | >= 2.0.0, <= 2.8.4 | 2.8.5 |