Vulnerabilities

TI-2026-44929 CVE-2026-62865

TypeBot: Arbitrary server file read via Send Email block attachment path

HIGH 77

Typebot is an open-source chatbot builder.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00321 Published 2026-08-25 Fixed in 3.18.0 CWE-200

TI-2026-44927 CVE-2026-62861

TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain

LOW 29

TypeBot is a chatbot builder tool.

CVSS 4.0MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00414 Published 2026-08-25 Fixed in 3.18.0 CWE-639

TI-2026-44928 CVE-2026-62862

TypeBot: Account takeover via brute-forceable 6-digit magic-link code

HIGH 74

Typebot is an open-source chatbot builder.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00529 Published 2026-08-25 Fixed in 3.18.0 CWE-307

TI-2026-36033 CVE-2026-48763

TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

HIGH 75

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00526 Published 2026-08-11 Fixed in 3.17.0 CWE-862

TI-2026-36032 CVE-2026-48762

TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler

LOW 24

TypeBot is a chatbot builder tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00304 Published 2026-08-11 Fixed in 3.16.0 CWE-918

TI-2026-36035 CVE-2026-48765

TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

HIGH 76

TypeBot is a chatbot builder tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00456 Published 2026-08-11 Fixed in 3.17.0 CWE-639

TI-2026-35208 CVE-2026-47705

TypeBot vulnerable to CSV injection in result export

HIGH 76

TypeBot is a chatbot builder tool.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00558 Published 2026-08-11 No fix listed CWE-1236

TI-2026-36037 CVE-2026-48767

Google Sheets OAuth access token disclosure to guest members via getAccessToken

HIGH 66

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.0043 Published 2026-08-11 Fixed in 3.17.0 CWE-200

TI-2026-35856 CVE-2026-48494

TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

MEDIUM 64

TypeBot is a chatbot builder tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00465 Published 2026-08-11 No fix listed CWE-639

TI-2026-35207 CVE-2026-47704

Authorization bypass in baptisteArno typebot.io

LOW 32

TypeBot is a chatbot builder tool.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00559 Published 2026-08-11 Fixed in 3.17.0 CWE-639

TI-2026-35846 CVE-2026-48483

TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server

MEDIUM 58

TypeBot is a chatbot builder tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00331 Published 2026-08-11 Fixed in 3.17.0 CWE-918

TI-2026-35857 CVE-2026-48495

TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots

MEDIUM 64

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00351 Published 2026-08-11 Fixed in 3.17.0 CWE-862

TI-2026-36036 CVE-2026-48766

TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl

LOW 34

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.0043 Published 2026-08-11 Fixed in 3.17.0 CWE-200

TI-2026-30473 CVE-2026-42142

TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

MEDIUM 64

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00369 Published 2026-08-11 Fixed in 3.17.0 CWE-862

TI-2026-35205 CVE-2026-47702

TypeBot API tokens stored in plaintext

HIGH 74

TypeBot is a chatbot builder tool.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00299 Published 2026-08-11 No fix listed CWE-312

TI-2026-36414 CVE-2026-49213

TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution

HIGH 70

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00405 Published 2026-07-10 Fixed in 3.17.2 CWE-918

TI-2026-36034 CVE-2026-48764

TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass

HIGH 75

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0033 Published 2026-06-17 Fixed in 3.17.2 CWE-918

TI-2026-36038 CVE-2026-48768

TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName

HIGH 79

TypeBot is a chatbot builder tool.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00326 Published 2026-06-17 Fixed in 3.17.0 CWE-22

TI-2026-36029 CVE-2026-48759

TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)

LOW 31

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00202 Published 2026-06-17 Fixed in 3.16.0 CWE-639

TI-2026-28825 CVE-2026-39969

TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification

HIGH 68

TypeBot is a chatbot builder tool.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0014 Published 2026-05-22 Fixed in 3.17.0 CWE-287

TI-2026-28823 CVE-2026-39967

TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter

MEDIUM 48

TypeBot is a chatbot builder tool.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00186 Published 2026-05-22 Fixed in 3.16.0 CWE-639

TI-2026-28824 CVE-2026-39968

TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint

MEDIUM 64

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00271 Published 2026-05-22 Fixed in 3.16.0 CWE-284

TI-2026-28822 CVE-2026-39966

Incorrect authorization in baptisteArno typebot.io

MEDIUM 62

TypeBot is a chatbot builder tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00256 Published 2026-05-22 Fixed in 3.16.0 CWE-863

TI-2026-28826 CVE-2026-39970

TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form

HIGH 70

TypeBot is a chatbot builder tool.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00276 Published 2026-05-22 Fixed in 3.16.0 CWE-79

TI-2026-28821 CVE-2026-39965

TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks

HIGH 67

TypeBot is a chatbot builder tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00239 Published 2026-05-22 Fixed in 3.16.0 CWE-918

Vulnerabilities

Filters