CVE-2025-10282: BBOT's gitlab.py exposes globally configured "gitlab" API key

October 27, 2025

bbot’s gitlab.py sends the user’s “gitlab” API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

References

blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper
github.com/advisories/GHSA-p3v4-c93g-cmhw
github.com/blacklanternsecurity/bbot
github.com/blacklanternsecurity/bbot/security/advisories/GHSA-p3v4-c93g-cmhw
nvd.nist.gov/vuln/detail/CVE-2025-10282

Code Behaviors & Features

Detect and mitigate CVE-2025-10282 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →