24
CVEs
4
Critical
13
High
0
KEV
0
PoC
9
Unpatched C/H
45.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
13
MEDIUM
6
LOW
1
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-33712 | Server-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers to abuse the preview chat endpoint to make arbitrary internal HTTP requests from the server. The flaw stems from the isolated-vm sandbox's fetch function calling Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects HTTP Request blocks, bypassing mitigations added after GHSA-8gq9-rw7v-3jpr. No public exploit identified at time of analysis, but the CVSS 10.0 (Critical) score with scope-changed impact indicates severe risk for both self-hosted and hosted deployments. | CRITICAL | 10.0 | 0.1% | 50 |
No patch
|
| CVE-2026-48765 | Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth `credentialsId` and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable `workspaceId`. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global `id` alone (and rewrote its `workspaceId`), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fixing commit and PR are public. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-48768 | Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visitors of any published bot containing a file-input block to write attacker-controlled HTML, SVG, or JavaScript into arbitrary subpaths of the shared public S3 bucket. The flaw stems from an unauthenticated presigned-URL endpoint that trusts a raw fileName parameter and does not bind Content-Type, enabling stored XSS on the storage origin and content hosting under other tenants' result paths. No public exploit identified at time of analysis, but the CVSS 9.3 (scope-changed) reflects significant cross-tenant impact. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-47702 | Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyone with read access to the backing database recover every user's builder-API credential verbatim and impersonate that user with no password or MFA. The tokens were persisted with the plaintext value returned by generateId(24) rather than a hash, so a single database disclosure - via SQL injection, an exposed backup, or insider access - yields full account takeover across all tenants. Version 3.17.0 remediates the flaw by SHA-256 hashing tokens at rest; there is no public exploit identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|
| CVE-2026-28445 | Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collaborator-crafted bot to execute arbitrary HTML/JavaScript in the authenticated builder context via the RatingButton component's customIcon.svg field. Because the builder preview renders bots inline on builder.typebot.io under a CSP permitting 'unsafe-inline', successful exploitation enables session hijacking and privilege escalation within the SaaS builder, with no public exploit identified at time of analysis. | HIGH | 8.7 | 0.0% | 44 |
|
| CVE-2026-39970 | Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a crafted SVG containing embedded JavaScript through the profile picture upload form; because the file is served unsanitized from the app.typebot.io domain via a permanent public link, the script executes in the browser of anyone who views it, enabling session/token theft, account takeover, and data exfiltration. Publicly available exploit code exists (SSVC: POC), but there is no confirmed active exploitation and EPSS is very low (0.05%, 15th percentile) with no CISA KEV listing. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2026-48763 | Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-48764 | Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to bypass SSRF protections via DNS rebinding, reaching internal services and cloud metadata endpoints. The validator resolves a hostname once for allowlist checks, but the subsequent HTTP request performs a fresh DNS resolution without IP pinning, creating a time-of-check to time-of-use (TOCTOU) gap. No public exploit identified at time of analysis, though the fix commit and detailed advisory are publicly available on GitHub. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-49213 | Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared SSRF validator using the IPv6 unspecified address :: (and its expanded form), which validateIPAddress in packages/lib/src/ssrf/validateHttpReqUrl.ts fails to block. By configuring a server-side HTTP Request block or guarded script fetch, an attacker coerces the Typebot server to reach local HTTP services via safeKy, including flows reachable through startChat and continueChat endpoints. No public exploit identified at time of analysis, but the fix is confirmed in 3.17.2 and the technical root cause is documented in the vendor advisory. | HIGH | 8.1 | 0.3% | 41 |
|
| CVE-2026-39965 | Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpReqUrl() SSRF filter by chaining an attacker-controlled HTTP 302 redirect, since the underlying ky and fetch clients follow redirects without re-validating the destination. This enables reaching AWS instance metadata at 169.254.169.254, private subnets, and container-internal services from the Typebot server, with realistic impact including theft of cloud IAM credentials. No public exploit identified at time of analysis, and the issue is fixed in version 3.16.0. | HIGH | 7.7 | 0.0% | 39 |
No patch
|
| CVE-2026-48766 | Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted OpenAI-compatible API keys by invoking the model-listing endpoint with an attacker-controlled baseUrl. The server decrypts the stored credential and forwards the secret in both the Authorization header and an explicit api-key header to whatever URL the guest supplies, effectively acting as a credential-delivery proxy. This vulnerability has no public exploit identified at time of analysis, but the attack is trivially exploitable by any authenticated workspace guest with read access. | HIGH | 7.6 | 0.3% | 38 |
|
| CVE-2026-34207 | Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSRF protections in Webhook and HTTP Request blocks by supplying attacker-controlled hostnames that resolve via DNS to loopback (127.0.0.1), cloud metadata (169.254.169.254), or RFC1918 private addresses. The validation logic only inspected the URL string and literal IP formats without performing DNS resolution, so a benign-looking domain could route the backend HTTP client to internal targets. No public exploit identified at time of analysis, though the GitHub Security Advisory and fix commit are publicly visible. | HIGH | 7.6 | 0.1% | 38 |
No patch
|
| CVE-2026-47704 | Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user holding read access to at least one typebot to inject arbitrary JSON payloads into a suspended webhook session owned by a completely different typebot on the same instance. The handler validates authorization against the caller-supplied typebotId but then resolves the session result record solely by resultId without binding it to the authorized typebot, enabling an attacker to mix a legitimately authorized typebotId and blockId with a foreign live resultId to hijack cross-tenant execution flow and advance the victim's business logic. No public exploit has been identified at time of analysis; vendor-released patch version 3.17.0 is available and resolves the flaw. | HIGH | 7.1 | 0.5% | 36 |
|
| CVE-2026-42142 | Unauthorized cross-workspace Google Sheets credential exposure in Typebot prior to version 3.17.0 allows any authenticated user to call the `POST /api/sheets/getSheets` endpoint with an arbitrary workspace ID, bypassing membership checks entirely. The handler decrypts and returns the target workspace's stored Google Sheets OAuth tokens along with spreadsheet metadata (sheet names, IDs, and column headers), constituting a direct credential theft vector against any workspace with a Google Sheets integration configured. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low exploitation complexity makes this a credible insider or multi-tenant threat. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-48495 | Cross-workspace credential injection in Typebot's Google Sheets OAuth callback allows an authenticated attacker to plant Google Sheets credentials into workspaces they do not own, and - if target IDs are known - attach those credentials to blocks inside victim Typebots. The root cause is that the OAuth callback decodes and blindly trusts a client-supplied, unprotected base64 JSON state parameter without verifying the authenticated user holds write access to the referenced workspaceId or typebotId. All Typebot versions prior to 3.17.0 are affected; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.3% | 36 |
|