PyPI/bbot CVE-2026-14966: low 3.1, EPSS 0.38%

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

Action: Upgrade bbot to 3.0.0 or later.

pip install bbot==3.0.0

Affected

Fixed versions

Sources

• osv: GHSA-xpf3-p7gm-7756
• https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-xpf3-p7gm-7756
• https://nvd.nist.gov/vuln/detail/CVE-2026-14966
• https://github.com/blacklanternsecurity/bbot/commit/3bc8d3a96f34f312853c9fcf8decee2a4e905f26
• https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b761abe28807735
• https://github.com/blacklanternsecurity/bbot
• https://github.com/pypa/advisory-database/tree/main/vulns/bbot/PYSEC-2026-3719.yaml

CVE-2026-14966 · published 2026-10-14T19:34:31Z · modified 2026-10-14T19:55:56.169306546Z · JSON