Platform
python
Component
bbot
Fixed in
2.6.2
2.7.0
CVE-2025-10284 describes a Remote Code Execution (RCE) vulnerability found in the unarchive.py script within bbot. This flaw allows a malicious website to manipulate bbot into writing arbitrary files to any location on a user's system. The vulnerability impacts versions of bbot up to and including 2.6.1.6915rc0. A fix is available in version 2.7.0.
The primary impact of CVE-2025-10284 is Remote Code Execution. An attacker controlling a malicious website can exploit this vulnerability by crafting a specific request that triggers the unarchive.py script to write files outside of its intended directory. This allows the attacker to execute arbitrary code on the user's system, effectively gaining control. The blast radius extends to any user who utilizes bbot to scan websites, particularly if they are unaware of the malicious nature of the target site. This vulnerability shares similarities with other file manipulation vulnerabilities where improper input validation leads to arbitrary file writes and subsequent code execution.
CVE-2025-10284 was publicly disclosed on 2025-10-09. The vulnerability's severity is considered CRITICAL due to the potential for Remote Code Execution. There are currently no known public proof-of-concept exploits available, but the ease of exploitation makes it a likely target. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.20% (41% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-10284 is to upgrade bbot to version 2.7.0 or later, which contains the necessary fix. If upgrading immediately is not feasible, consider temporarily disabling the unarchive.py script if it's not essential to your workflow. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to inspect requests to unarchive.py for suspicious patterns. Monitor system logs for unusual file creation activity, particularly in unexpected locations. After upgrading, confirm the fix by attempting to scan a known safe website and verifying that no unexpected files are created.
Update the bbot package to a version later than 2.6.1. This can be done using the Python package manager, pip, by running the command: `pip install --upgrade bbot`. This will install the latest available version containing the security fix.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-10284 is a CRITICAL Remote Code Execution vulnerability in bbot's unarchive.py script, allowing malicious websites to execute code on a user's system.
You are affected if you are using bbot version 2.6.1.6915rc0 or earlier. Upgrade to version 2.7.0 to resolve the vulnerability.
Upgrade bbot to version 2.7.0 or later. If immediate upgrade is not possible, temporarily disable the unarchive.py script.
While no public exploits are currently known, the vulnerability's severity and ease of exploitation suggest it may become a target.
Refer to the bbot project's official website or GitHub repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.