EUVD-2026-56975Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Authenticated network access required (PR:L, AV:N, AC:L); impact is confidentiality-only via SSRF response leak; no integrity or availability impact from the described attack path.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch() without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitrary internal addresses and localhost. The fetched content is passed to the OpenAI Whisper API and the transcription result is returned to the attacker. Version 3.16.0 fixes the issue.
AnalysisAI
Server-Side Request Forgery (SSRF) in Typebot's OpenAI 'Create Transcription' action handler allows authenticated users to direct the Typebot server to fetch arbitrary internal or localhost URLs via a user-supplied audio URL parameter. The unprotected fetch() call in createTranscriptionHandler.ts bypasses the safeKy SSRF guard used elsewhere in the codebase, enabling internal network reconnaissance with response content leaked back through the OpenAI Whisper transcription result. Versions prior to 3.16.0 are affected; the fix is confirmed released and no public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
Typebot (CPE: cpe:2.3:a:baptistearno:typebot.io:*:*:*:*:*:*:*:*) is an open-source chatbot builder that integrates with external AI services including OpenAI. The vulnerable code path is the OpenAI 'Create Transcription' action handler (packages/forge/blocks/openai/src/handlers/createTranscriptionHandler.ts), which accepts a user-supplied URL and previously called the native fetch() directly rather than the project's SSRF-hardened safeKy wrapper. The root cause is CWE-918 (Server-Side Request Forgery), where insufficient URL validation allows an authenticated user to supply internal addresses (loopback, RFC-1918 ranges, cloud metadata endpoints such as 169.254.169.254) as the audio source. The safeKy wrapper - which validates URLs via validateHttpReqUrl, enforces redirect-following with per-hop re-validation (up to 10 hops), and blocks non-HTTP protocols - was already present for other handlers but was not applied to this specific one. The fix in PR #2428 and commit a33051755f9e734596498851d5f61bd2e171f192 replaces the raw fetch() call with safeKy.get() and also patches similar gaps in splitUserTextMessageIntoBlocks, sendFeedEventHandler, buildEmail, and splitUserTextMessageIntoOpenAIBlocks.
RemediationAI
Upgrade to Typebot version 3.16.0 or later; this is a confirmed vendor-released patch available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0. The fix replaces the unprotected fetch() call in the OpenAI transcription handler and several other handlers with the project's safeKy wrapper, which validates URLs against loopback addresses, private IP ranges (10.0.0.0/8, 192.168.0.0/16), cloud metadata endpoints, and non-HTTP protocols, and re-validates each redirect hop. If an immediate upgrade is not possible, operators can mitigate by disabling the OpenAI 'Create Transcription' block in their Typebot workspaces, though this removes transcription functionality entirely. Network-level mitigations - such as configuring egress firewall rules on the Typebot host to block outbound connections to RFC-1918 ranges and 169.254.169.254 - provide meaningful defense-in-depth but do not address the full SSRF surface (internal DNS resolution and other non-blocked ranges may still be reachable). There are no other published workarounds in the vendor advisory.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today