PatchTheCVEbbot vulnerabilities and fixes
Recent CVEs affecting bbot, with upgrade or downgrade steps. 2 tracked.
bbot has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-07-08. Highest priority: CVE-2026-14966 (score 19/100).
- CVE-2026-14966 LOW 3.1 UPGRADE BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z arch
- CVE-2026-14967 LOW 3.1 UPGRADE BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output
FAQ
How do I fix bbot vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bbot being exploited right now?
None of the tracked bbot CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bbot CVE should I patch first?
CVE-2026-14966 currently ranks highest (19/100): BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z arch.