CVE-2026-12567: Black Lantern Security Bbot

Low severity, CVSS 2.2. EPSS: 0.1% chance of exploitation in the next 30 days.

The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.

Affected products

• Black Lantern Security Bbot: from 2.0.0, up to and including 2.8.4

Published 2026-06-17. Last modified 2026-06-22.