-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe analysis of the vulnerability is based on the provided commit 6325f2f4f8f6f4545703e4c9b8004e69f71bec82 and the related security advisory blog post. The commit diff clearly shows that the handle_event function in bbot/modules/internal/unarchive.py was modified to address a security issue. The blog post for CVE-2025-10284 confirms that the vulnerability was due to improper archive extraction that could lead to arbitrary file writes and RCE. The vulnerability was caused by a directory name collision, which allowed an attacker to write files to an unintended location. The patch addresses this by explicitly checking if the destination directory already exists and aborting the extraction if it does. Therefore, the handle_event function is identified as the vulnerable function as it was responsible for the unsafe extraction process.
unarchive.handle_eventbbot/modules/internal/unarchive.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bbot | pip | < 2.7.0 | 2.7.0 |
Ongoing coverage of React2Shell