EUVD-2026-43109Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable via chat endpoints (AV:N, AC:L), but requires an authenticated workspace editor/creator to configure the block (PR:L); SSRF exposes and manipulates internal services (C:H/I:H) without availability impact (A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecified address :: because validateIPAddress blocks local, metadata, and private ranges but does not block :: or its expanded form. A workspace editor or creator can configure a server-side HTTP Request block or guarded script fetch to make the Typebot server connect to local HTTP services through safeKy, including flows triggered by POST /v1/typebots/{publicId}/startChat or POST /v1/sessions/{sessionId}/continueChat. This issue is fixed in version 3.17.2.
AnalysisAI
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared SSRF validator using the IPv6 unspecified address :: (and its expanded form), which validateIPAddress in packages/lib/src/ssrf/validateHttpReqUrl.ts fails to block. By configuring a server-side HTTP Request block or guarded script fetch, an attacker coerces the Typebot server to reach local HTTP services via safeKy, including flows reachable through startChat and continueChat endpoints. No public exploit identified at time of analysis, but the fix is confirmed in 3.17.2 and the technical root cause is documented in the vendor advisory.
Technical ContextAI
Typebot is an open-source chatbot builder whose server-side features (HTTP Request blocks, guarded script fetches) make outbound HTTP calls on behalf of a bot flow through the safeKy wrapper. To prevent those outbound calls from reaching internal infrastructure, Typebot uses a shared allow/deny validator, validateHttpReqUrl.ts, whose validateIPAddress function blocks loopback, cloud metadata, and RFC1918 private ranges. This is a classic CWE-918 (Server-Side Request Forgery) deny-list gap: the validator enumerates known-bad ranges but omits the IPv6 unspecified address :: (0:0:0:0:0:0:0:0). On most stacks :: routes to loopback/localhost when used as a connection target, so a request to that address slips past the filter and lets the server-side fetch reach services bound locally on the Typebot host. The affected code path is exercised by request flows such as POST /v1/typebots/{publicId}/startChat and POST /v1/sessions/{sessionId}/continueChat.
RemediationAI
Vendor-released patch: upgrade Typebot to version 3.17.2, which extends validateIPAddress to block the IPv6 unspecified address :: and its expanded form (fix commit f56c3c3f771df13a8c11e88f500dfdd78981bed1, PR https://github.com/baptisteArno/typebot.io/pull/2511, release https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.2, advisory https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qx46-p88f-xxm3). If you cannot upgrade immediately, restrict who holds workspace editor/creator roles to reduce the pool of users who can configure server-side HTTP Request blocks, and place egress controls around the Typebot server so it cannot reach loopback, link-local, or metadata endpoints - for example, run the server in a network namespace or firewall that denies outbound connections to 127.0.0.0/8, ::1, ::, and 169.254.0.0/16 (trade-off: legitimate integrations that intentionally call internal services will break and must be allow-listed). Disabling or gating the HTTP Request block and guarded script features removes the attack surface entirely but also removes that functionality for all users.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today