What is the CVSS score of CVE-2026-33712?

CVE-2026-33712 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Typebot are affected by CVE-2026-33712?

Typebot chatbot builder (versions 3.15.2 and prior) contains a critical server-side request forgery vulnerability in the preview chat endpoint that allows unauthenticated attackers to trigger…

How to fix or mitigate CVE-2026-33712?

Within 24 hours: Inventory all Typebot deployments and assess whether the preview chat endpoint is exposed to untrusted users; if not business-critical, disable it immediately. Within 7 days: Implement network segmentation to restrict Typebot server outbound connectivity to only required destinations; deploy WAF or reverse proxy rules to block suspicious internal IP requests from the preview endpoint. Within 30 days: Monitor Typebot security advisories and vendor releases closely for a patched version; plan upgrade timeline once patch is available; conduct internal scan for evidence of exploitation via Typebot server access logs.

Typebot CVE-2026-33712

CRITICAL

Missing Authorization (CWE-862)

2026-05-22 GitHub_M

Authentication Bypass SSRF Node.js Typebot Io Baptistearno

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 22, 2026 - 17:45 vuln.today

Analysis Generated

May 22, 2026 - 17:45 vuln.today

DescriptionCVE.org

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthenticated users to achieve Server-Side Request Forgery (SSRF) by supplying a custom typebot definition with server-side code blocks. The fetch function exposed inside the isolated-vm sandbox calls Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects the HTTP Request block. This bypasses all SSRF mitigations added after GHSA-8gq9-rw7v-3jpr. Exploitation of this unauthenticated SSRF vulnerability can lead to cloud credential theft, internal network access and data exfiltration for any self-hosted Typebot deployments and hosted services. This issue has been fixed in version 3.16.0.

AnalysisAI

Server-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers to abuse the preview chat endpoint to make arbitrary internal HTTP requests from the server. The flaw stems from the isolated-vm sandbox's fetch function calling Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects HTTP Request blocks, bypassing mitigations added after GHSA-8gq9-rw7v-3jpr. No public exploit identified at time of analysis, but the CVSS 10.0 (Critical) score with scope-changed impact indicates severe risk for both self-hosted and hosted deployments.

Technical ContextAI

Typebot (baptistearno/typebot.io per CPE) is a Node.js-based open-source chatbot builder that supports server-side code blocks executed inside an isolated-vm sandbox. The sandbox exposes a fetch function that wraps Node.js native fetch, which is the root cause of this vulnerability: the wrapper omits the validateHttpReqUrl SSRF guard that the dedicated HTTP Request block uses to block private IP ranges, localhost, and cloud metadata endpoints. The CWE-862 (Missing Authorization) classification reflects that the preview chat endpoint POST /api/v1/typebots/{typebotId}/preview/startChat accepts a user-supplied typebot definition with no authentication, allowing arbitrary code paths to be reached inside the sandbox without authorization checks.

RemediationAI

Vendor-released patch: upgrade to Typebot 3.16.0 or later, available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0, which restores SSRF validation on the sandboxed fetch function (see advisory GHSA-vc2q-r6rq-ggj9 at https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-vc2q-r6rq-ggj9). If immediate upgrade is not possible, compensating controls include blocking external access to /api/v1/typebots/*/preview/startChat at a reverse proxy or WAF (trade-off: breaks the builder preview feature for legitimate users), placing the Typebot server in a network segment with egress filtering that denies traffic to RFC1918 ranges, link-local 169.254.169.254 cloud metadata endpoints, and other internal services (trade-off: may break legitimate outbound integrations), and on AWS forcing IMDSv2 with a hop limit of 1 to neutralize metadata credential theft (trade-off: requires SDK compatibility verification).