Typebot
Monthly
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. [CVSS 7.4 HIGH]
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue arbitrary server-side HTTP requests to internal endpoints, including the AWS Instance Metadata Service at 169.254.169.254. By injecting custom headers that defeat IMDSv2 session-token enforcement, an attacker can pull temporary IAM credentials for the EKS node role when Typebot runs on an EKS node in AWS, escalating a single low-privilege account into full Kubernetes cluster and AWS infrastructure compromise. Publicly available exploit code exists, though EPSS remains low (0.06%, 18th percentile) and the credential-theft outcome only applies to AWS/EKS deployments where IMDS is reachable from the application; version 3.13.1 contains the fix.
Typebot 3.9.0 through 3.12.x contains an insecure direct object reference in its API token management endpoint that allows any authenticated user to delete another user's API token and retrieve its value by supplying the victim's user ID and token ID. The endpoint performs no authorization check, so the flaw is most relevant to multiuser, multi-tenant, or publicly registerable Typebot instances where an attacker can obtain a valid account. Publicly available exploit code exists, but there is no KEV-based confirmation of active exploitation; EPSS is low at 0.08% (23rd percentile).
Typebot is an open-source chatbot builder. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. [CVSS 7.4 HIGH]
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue arbitrary server-side HTTP requests to internal endpoints, including the AWS Instance Metadata Service at 169.254.169.254. By injecting custom headers that defeat IMDSv2 session-token enforcement, an attacker can pull temporary IAM credentials for the EKS node role when Typebot runs on an EKS node in AWS, escalating a single low-privilege account into full Kubernetes cluster and AWS infrastructure compromise. Publicly available exploit code exists, though EPSS remains low (0.06%, 18th percentile) and the credential-theft outcome only applies to AWS/EKS deployments where IMDS is reachable from the application; version 3.13.1 contains the fix.
Typebot 3.9.0 through 3.12.x contains an insecure direct object reference in its API token management endpoint that allows any authenticated user to delete another user's API token and retrieve its value by supplying the victim's user ID and token ID. The endpoint performs no authorization check, so the flaw is most relevant to multiuser, multi-tenant, or publicly registerable Typebot instances where an attacker can obtain a valid account. Publicly available exploit code exists, but there is no KEV-based confirmation of active exploitation; EPSS is low at 0.08% (23rd percentile).
Typebot is an open-source chatbot builder. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.