EUVD-2026-56219Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSRF impact falls on internal/other systems (S:C); PR:L because workspace authentication with WhatsApp settings access is required; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw ky instance instead of the repository's SSRF-protected safeKy client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.
AnalysisAI
Server-Side Request Forgery (SSRF) in Typebot's WhatsApp status webhook forwarding allows an authenticated workspace user to pivot the Typebot server into probing or interacting with internal network hosts, cloud metadata endpoints, or localhost services. The vulnerability exists in all Typebot versions prior to 3.17.0 and is triggered server-side whenever the public WhatsApp webhook receives a status payload, requiring no further interaction after the malicious URL is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any workspace member with WhatsApp integration configuration access.
Technical ContextAI
Typebot (CPE: cpe:2.3:a:baptistearno:typebot.io:*) is an open-source chatbot builder with a WhatsApp integration that forwards status events (marketing/error callbacks from the WhatsApp Cloud API) to a workspace-configured webhook URL. The repository maintains two HTTP client instances: a standard ky client and a safeKy client that enforces SSRF protections by blocking requests to private RFC-1918 ranges, loopback addresses, link-local (169.254.x.x) metadata endpoints, and similar restricted targets. The vulnerable code path in packages/whatsapp/src/forwardStatusWebhooks.ts used the unprotected ky.post() instead of safeKy.post() when dispatching forwarded status payloads. Because the stored webhook URL is validated only as a syntactically valid URL at configuration time, an attacker-controlled URL pointing to an internal resource passes validation. CWE-918 (Server-Side Request Forgery) is the root-cause class: the server makes outbound HTTP requests to attacker-controlled destinations without adequate destination filtering.
RemediationAI
Upgrade Typebot to version 3.17.0 or later, which replaces the unsafe ky.post() call with safeKy.post() in packages/whatsapp/src/forwardStatusWebhooks.ts (GitHub release tag v3.17.0, PR #2497, commit 30cbc616e00efabb193c3221b36a0d417152592c). The GitHub Security Advisory is at https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx. If immediate upgrade is not feasible, a compensating control for self-hosted deployments is to restrict outbound HTTP egress from the Typebot server at the network layer to only permitted external destinations, blocking RFC-1918 ranges, loopback, and link-local addresses - this trades some integration flexibility for protection and should be considered a temporary measure. Additionally, auditing and removing WhatsApp settings access from untrusted workspace members reduces the exploitable population until the patch is applied.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today