TypeBot vulnerabilities

Typebot before version 3.13.2 allows client-side script execution that can steal all stored credentials from any user. When a victim previews a malicious typebot, JavaScript executes in their browser and exfiltrates OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership.

Typebot up to version 3.17.1 (self-hosted) has a brute-force vulnerability in the default passwordless email magic-link authentication. The code is generated using Math.random() and has only 900,000 possible combinations, with no attempt limits or lockouts, allowing account takeover. An attacker knowing the victim's email address can gain full access without victim interaction.

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.

TypeBot version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.

TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.

TypeBot is a chatbot builder tool that in versions 3.16.1 and earlier has an unauthenticated endpoint for generating upload URLs. This allows anonymous users to upload malicious HTML, SVG, or JS files, potentially leading to stored XSS.

SQL injection in the 'two_steps_auth_code' parameter processed by the 'twoStepsAuthVerification' function in the '/user-login' endpoint. The 2FA functionality is accessible without authentication, allowing unauthenticated attackers to execute arbitrary SQL queries. Successful exploit can lead to database enumeration, unauthorized creation of privileged users, modification or deletion of critical information, and denial of service.

Typebot versions 3.15.2 and prior have an SSRF vulnerability in the preview chat endpoint. An unauthenticated attacker can supply a custom typebot definition with server-side code, bypassing SSRF validation and making network requests from the server.

Typebot, an open-source chatbot builder, in versions prior to 3.13.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the webhook block (HTTP Request component). Authenticated users can make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.

Typebot in self-hosted versions prior to 3.18.0 has a vulnerability in the Send Email integration block that allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from typebot variables, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL. The Nodemailer transport is created without disabling file access, so an attachment specified as an absolute server path is read from the local filesystem and delivered.

TypeBot prior to 3.18.0 has a vulnerability that allows any authenticated non-guest workspace member to remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace.

TypeBot, a chatbot builder tool, prior to version 3.17.0 exposes a deprecated public upload endpoint that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL. An unauthenticated attacker who knows a valid public typebotId and blockId can request presigned upload URLs for arbitrary objects in the shared bucket, including private/ and other tenants' public/ paths.

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()` without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitrary internal addresses and localhost. The fetched content is passed to the OpenAI Whisper API and the transcription result is returned to the attacker. Version 3.16.0 fixes the issue.

TypeBot before version 3.17.0 allows a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token, and returns the raw bearer token directly to the caller. Guests can also enumerate credential identifiers, allowing them to mint and reuse the workspace's Google access token outside Typebot.

TypeBot version 3.16.1 allows an authenticated user with read access to any typebot to resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign preview phone number tied to another preview session. The WhatsApp test-webhook handler authorizes the parent typebot first, but then resolves the preview chat session only by `wa-preview-{phone}`. As a result, an attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft/unpublished flow without any access to the victim typebot.

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign live `resultId`. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant `result` only by `resultId`. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue.

TypeBot before version 3.17.0 allows a low-privilege guest member to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace credential and sends the outbound request to the caller-supplied URL, delivering the secret to attacker infrastructure. Version 3.17.0 patches the issue.

TypeBot before version 3.17.0 in the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded values without cryptographic integrity protection or authorization checks. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` to create credentials in another workspace and attach them to a block in another Typebot. Version 3.17.0 patches the issue.

TypeBot before version 3.17.0 in the `handleGetSheets` API handler does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data. Version 3.17.0 fixes the issue.

An SSRF vulnerability in TypeBot prior to 3.17.2 allows bypassing the URL validator by using the IPv6 unspecified address ::. A workspace editor or creator can configure a server-side HTTP Request block or script fetch to connect to local HTTP services.

TypeBot is a chatbot builder tool that in versions prior to 3.17.2 has a vulnerability in SSRF validation. The issue is that the IP validation is not properly tied to subsequent requests, allowing attackers to exploit DNS rebinding to bypass protections.

TypeBot is a chatbot builder tool that has an Insecure Direct Object Reference vulnerability in versions 3.15.2 and below. This allows authenticated users to modify or delete theme templates from other workspaces.

TypeBot versions up to 3.15.2 contain a critical stored XSS vulnerability in the profile picture upload form at app.typebot.io. The application does not sanitize SVG/XML files, allowing upload of a malicious SVG file with embedded JavaScript that executes in the victim's browser.

TypeBot, a chatbot builder tool, in versions 3.16.0 and prior does not verify the x-hub-signature-256 HMAC signature in WhatsApp Cloud API webhooks. Additionally, workspaceId and credentialsId are exposed in logs and Meta dashboard, allowing unauthenticated attackers to send spoofed webhook messages, trigger bots, and consume API resources.

TypeBot versions 3.15.2 and prior have an incomplete fix for GHSA-4xc5-wfwc-jw47. Although the builder's getCredentials tRPC endpoint was patched, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The getCredentials() function uses a falsy check (if (workspaceId && ...)), and an attacker can supply workspaceId: "" to bypass ownership verification.

In TypeBot up to version 3.15.2, the bot engine's findResult query does not filter by typebotId, allowing an authenticated user to load result data from another typebot by supplying a foreign resultId to the startChat endpoint. This issue is fixed in version 3.16.0.

In TypeBot versions up to 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user referencing a bot ID from another workspace, leading to IDOR. The access control is ineffective due to using Array.filter() with an async callback. Fixed in version 3.16.0.

TypeBot versions up to 3.15.2 have an SSRF vulnerability via Open Redirect Bypass. The validateHttpReqUrl() function blocks private IPs and cloud metadata hosts, but HTTP clients (ky and fetch) follow 302 redirects without re-validating the destination.

In TypeBot prior to version 3.16.0, the viewer renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context.

TypeBot versions prior to 3.16.0 have incomplete SSRF protection for Webhook/HTTP Request blocks. Validation only checks hostname literals and IP formats but does not resolve DNS before allowing the request.

Typebot versions 3.15.2 and earlier have an HTML/JS injection vulnerability in the RatingButton component, which renders the customIcon.svg field via innerHTML without sanitization. An attacker can inject malicious code that executes in the context of an authenticated user in the builder panel, bypassing the Web Worker sandbox.

Typebot versions 3.15.2 and earlier have an IDOR vulnerability in the getResultLogs API endpoint. An authenticated attacker can read execution logs from other workspaces by supplying their own typebotId and a victim's resultId, leaking sensitive data.

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.