CVE-2026-14967

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14967
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14967.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14967
Aliases
Published
2026-07-08T16:16:27.373Z
Modified
2026-08-21T03:46:24.690728319Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

BBOT's github_workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE_REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.1.7"
                },
                {
                    "last_affected": "2.8.6"
                }
            ],
            "cpes": [
                "cpe:2.3:a:blacklanternsecurity:bbot:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "blacklanternsecurity:bbot"
        }
    ]
}
References

Affected packages

Git / github.com/blacklanternsecurity/bbot

Affected ranges

Type
GIT
Repo
https://github.com/blacklanternsecurity/bbot
Events
Introduced
233c86ca8d277fe87c86b6cdce2499745b973c70
Last affected
e3baa4a4aae8b5cdb4ca623eb1fc6f12fe919ab0
Fixed
c1c6ec05ff998e2fba55a14d1026f12563ccd82f
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.0:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.647:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.649:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.652:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.654:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.659:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.669:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.671:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.673:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.691:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.765:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.767:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.773:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.782:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.786:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.793:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.795:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.798:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.819:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.821:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.829:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.836:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.849:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.851:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.858:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.870:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.876:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.884:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.897:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.903:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.907:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.909:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.981:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.986:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1056:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1062:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1064:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1068:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1070:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1079:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1137:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1139:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1141:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1153:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1173:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1184:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1190:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1254:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1271:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1274:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1304:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1313:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1317:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1333:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1343:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1345:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1349:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1386:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1388:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1390:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1401:rc:*:*:*:*:*:*",
        "cpe:2.3:a:blacklanternsecurity:bbot:3.0.0.1407:rc:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0.0-rc"
        },
        {
            "last_affected": "3.0.0.0-rc"
        },
        {
            "introduced": "3.0.0.647-rc"
        },
        {
            "last_affected": "3.0.0.647-rc"
        },
        {
            "introduced": "3.0.0.649-rc"
        },
        {
            "last_affected": "3.0.0.649-rc"
        },
        {
            "introduced": "3.0.0.652-rc"
        },
        {
            "last_affected": "3.0.0.652-rc"
        },
        {
            "introduced": "3.0.0.654-rc"
        },
        {
            "last_affected": "3.0.0.654-rc"
        },
        {
            "introduced": "3.0.0.659-rc"
        },
        {
            "last_affected": "3.0.0.659-rc"
        },
        {
            "introduced": "3.0.0.669-rc"
        },
        {
            "last_affected": "3.0.0.669-rc"
        },
        {
            "introduced": "3.0.0.671-rc"
        },
        {
            "last_affected": "3.0.0.671-rc"
        },
        {
            "introduced": "3.0.0.673-rc"
        },
        {
            "last_affected": "3.0.0.673-rc"
        },
        {
            "introduced": "3.0.0.691-rc"
        },
        {
            "last_affected": "3.0.0.691-rc"
        },
        {
            "introduced": "3.0.0.765-rc"
        },
        {
            "last_affected": "3.0.0.765-rc"
        },
        {
            "introduced": "3.0.0.767-rc"
        },
        {
            "last_affected": "3.0.0.767-rc"
        },
        {
            "introduced": "3.0.0.773-rc"
        },
        {
            "last_affected": "3.0.0.773-rc"
        },
        {
            "introduced": "3.0.0.782-rc"
        },
        {
            "last_affected": "3.0.0.782-rc"
        },
        {
            "introduced": "3.0.0.786-rc"
        },
        {
            "last_affected": "3.0.0.786-rc"
        },
        {
            "introduced": "3.0.0.793-rc"
        },
        {
            "last_affected": "3.0.0.793-rc"
        },
        {
            "introduced": "3.0.0.795-rc"
        },
        {
            "last_affected": "3.0.0.795-rc"
        },
        {
            "introduced": "3.0.0.798-rc"
        },
        {
            "last_affected": "3.0.0.798-rc"
        },
        {
            "introduced": "3.0.0.819-rc"
        },
        {
            "last_affected": "3.0.0.819-rc"
        },
        {
            "introduced": "3.0.0.821-rc"
        },
        {
            "last_affected": "3.0.0.821-rc"
        },
        {
            "introduced": "3.0.0.829-rc"
        },
        {
            "last_affected": "3.0.0.829-rc"
        },
        {
            "introduced": "3.0.0.836-rc"
        },
        {
            "last_affected": "3.0.0.836-rc"
        },
        {
            "introduced": "3.0.0.849-rc"
        },
        {
            "last_affected": "3.0.0.849-rc"
        },
        {
            "introduced": "3.0.0.851-rc"
        },
        {
            "last_affected": "3.0.0.851-rc"
        },
        {
            "introduced": "3.0.0.858-rc"
        },
        {
            "last_affected": "3.0.0.858-rc"
        },
        {
            "introduced": "3.0.0.870-rc"
        },
        {
            "last_affected": "3.0.0.870-rc"
        },
        {
            "introduced": "3.0.0.876-rc"
        },
        {
            "last_affected": "3.0.0.876-rc"
        },
        {
            "introduced": "3.0.0.884-rc"
        },
        {
            "last_affected": "3.0.0.884-rc"
        },
        {
            "introduced": "3.0.0.897-rc"
        },
        {
            "last_affected": "3.0.0.897-rc"
        },
        {
            "introduced": "3.0.0.903-rc"
        },
        {
            "last_affected": "3.0.0.903-rc"
        },
        {
            "introduced": "3.0.0.907-rc"
        },
        {
            "last_affected": "3.0.0.907-rc"
        },
        {
            "introduced": "3.0.0.909-rc"
        },
        {
            "last_affected": "3.0.0.909-rc"
        },
        {
            "introduced": "3.0.0.981-rc"
        },
        {
            "last_affected": "3.0.0.981-rc"
        },
        {
            "introduced": "3.0.0.986-rc"
        },
        {
            "last_affected": "3.0.0.986-rc"
        },
        {
            "introduced": "3.0.0.1056-rc"
        },
        {
            "last_affected": "3.0.0.1056-rc"
        },
        {
            "introduced": "3.0.0.1062-rc"
        },
        {
            "last_affected": "3.0.0.1062-rc"
        },
        {
            "introduced": "3.0.0.1064-rc"
        },
        {
            "last_affected": "3.0.0.1064-rc"
        },
        {
            "introduced": "3.0.0.1068-rc"
        },
        {
            "last_affected": "3.0.0.1068-rc"
        },
        {
            "introduced": "3.0.0.1070-rc"
        },
        {
            "last_affected": "3.0.0.1070-rc"
        },
        {
            "introduced": "3.0.0.1079-rc"
        },
        {
            "last_affected": "3.0.0.1079-rc"
        },
        {
            "introduced": "3.0.0.1137-rc"
        },
        {
            "last_affected": "3.0.0.1137-rc"
        },
        {
            "introduced": "3.0.0.1139-rc"
        },
        {
            "last_affected": "3.0.0.1139-rc"
        },
        {
            "introduced": "3.0.0.1141-rc"
        },
        {
            "last_affected": "3.0.0.1141-rc"
        },
        {
            "introduced": "3.0.0.1153-rc"
        },
        {
            "last_affected": "3.0.0.1153-rc"
        },
        {
            "introduced": "3.0.0.1173-rc"
        },
        {
            "last_affected": "3.0.0.1173-rc"
        },
        {
            "introduced": "3.0.0.1184-rc"
        },
        {
            "last_affected": "3.0.0.1184-rc"
        },
        {
            "introduced": "3.0.0.1190-rc"
        },
        {
            "last_affected": "3.0.0.1190-rc"
        },
        {
            "introduced": "3.0.0.1254-rc"
        },
        {
            "last_affected": "3.0.0.1254-rc"
        },
        {
            "introduced": "3.0.0.1271-rc"
        },
        {
            "last_affected": "3.0.0.1271-rc"
        },
        {
            "introduced": "3.0.0.1274-rc"
        },
        {
            "last_affected": "3.0.0.1274-rc"
        },
        {
            "introduced": "3.0.0.1304-rc"
        },
        {
            "last_affected": "3.0.0.1304-rc"
        },
        {
            "introduced": "3.0.0.1313-rc"
        },
        {
            "last_affected": "3.0.0.1313-rc"
        },
        {
            "introduced": "3.0.0.1317-rc"
        },
        {
            "last_affected": "3.0.0.1317-rc"
        },
        {
            "introduced": "3.0.0.1333-rc"
        },
        {
            "last_affected": "3.0.0.1333-rc"
        },
        {
            "introduced": "3.0.0.1343-rc"
        },
        {
            "last_affected": "3.0.0.1343-rc"
        },
        {
            "introduced": "3.0.0.1345-rc"
        },
        {
            "last_affected": "3.0.0.1345-rc"
        },
        {
            "introduced": "3.0.0.1349-rc"
        },
        {
            "last_affected": "3.0.0.1349-rc"
        },
        {
            "introduced": "3.0.0.1386-rc"
        },
        {
            "last_affected": "3.0.0.1386-rc"
        },
        {
            "introduced": "3.0.0.1388-rc"
        },
        {
            "last_affected": "3.0.0.1388-rc"
        },
        {
            "introduced": "3.0.0.1390-rc"
        },
        {
            "last_affected": "3.0.0.1390-rc"
        },
        {
            "introduced": "3.0.0.1401-rc"
        },
        {
            "last_affected": "3.0.0.1401-rc"
        },
        {
            "introduced": "3.0.0.1407-rc"
        },
        {
            "last_affected": "3.0.0.1407-rc"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0.0-rc
3.0.0.1056-rc
3.0.0.1062-rc
3.0.0.1064-rc
3.0.0.1068-rc
3.0.0.1070-rc
3.0.0.1079-rc
3.0.0.1137-rc
3.0.0.1139-rc
3.0.0.1141-rc
3.0.0.1153-rc
3.0.0.1173-rc
3.0.0.1184-rc
3.0.0.1190-rc
3.0.0.1254-rc
3.0.0.1271-rc
3.0.0.1274-rc
3.0.0.1304-rc
3.0.0.1313-rc
3.0.0.1317-rc
3.0.0.1333-rc
3.0.0.1343-rc
3.0.0.1345-rc
3.0.0.1349-rc
3.0.0.1386-rc
3.0.0.1388-rc
3.0.0.1390-rc
3.0.0.1401-rc
3.0.0.1407-rc
3.0.0.647-rc
3.0.0.649-rc
3.0.0.652-rc
3.0.0.654-rc
3.0.0.659-rc
3.0.0.669-rc
3.0.0.671-rc
3.0.0.673-rc
3.0.0.691-rc
3.0.0.765-rc
3.0.0.767-rc
3.0.0.773-rc
3.0.0.782-rc
3.0.0.786-rc
3.0.0.793-rc
3.0.0.795-rc
3.0.0.798-rc
3.0.0.819-rc
3.0.0.821-rc
3.0.0.829-rc
3.0.0.836-rc
3.0.0.849-rc
3.0.0.851-rc
3.0.0.858-rc
3.0.0.870-rc
3.0.0.876-rc
3.0.0.884-rc
3.0.0.897-rc
3.0.0.903-rc
3.0.0.907-rc
3.0.0.909-rc
3.0.0.981-rc
3.0.0.986-rc
Other
v
v3.*
v3.0.0.0rc
v3.0.0.1056rc
v3.0.0.1062rc
v3.0.0.1064rc
v3.0.0.1068rc
v3.0.0.1070rc
v3.0.0.1079rc
v3.0.0.1137rc
v3.0.0.1139rc
v3.0.0.1141rc
v3.0.0.1153rc
v3.0.0.1173rc
v3.0.0.1184rc
v3.0.0.1190rc
v3.0.0.1254rc
v3.0.0.1271rc
v3.0.0.1274rc
v3.0.0.1304rc
v3.0.0.1313rc
v3.0.0.1317rc
v3.0.0.1333rc
v3.0.0.1343rc
v3.0.0.1345rc
v3.0.0.1349rc
v3.0.0.1386rc
v3.0.0.1388rc
v3.0.0.1390rc
v3.0.0.1401rc
v3.0.0.1407rc
v3.0.0.647rc
v3.0.0.649rc
v3.0.0.652rc
v3.0.0.654rc
v3.0.0.659rc
v3.0.0.669rc
v3.0.0.671rc
v3.0.0.673rc
v3.0.0.691rc
v3.0.0.765rc
v3.0.0.767rc
v3.0.0.773rc
v3.0.0.782rc
v3.0.0.786rc
v3.0.0.793rc
v3.0.0.795rc
v3.0.0.798rc
v3.0.0.819rc
v3.0.0.821rc
v3.0.0.829rc
v3.0.0.836rc
v3.0.0.849rc
v3.0.0.851rc
v3.0.0.858rc
v3.0.0.870rc
v3.0.0.876rc
v3.0.0.884rc
v3.0.0.897rc
v3.0.0.903rc
v3.0.0.907rc
v3.0.0.909rc
v3.0.0.981rc
v3.0.0.986rc

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14967.json"