Product by Baptistearno

    Typebot.io

    34 known vulnerabilities in Typebot.io (Baptistearno), 0 of them actively exploited (CISA KEV).

    Key figures

    34

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Typebot.io (Baptistearno)
    CriticalCVE-2026-47705

    TypeBot vulnerable to CSV injection in result export

    		9.6
    CriticalCVE-2026-62862

    TypeBot: Account takeover via brute-forceable 6-digit magic-link code

    		—
    CriticalCVE-2026-48765

    baptisteArno Typebot.io: Authorization Bypass Through User-Controlled Key

    		9.9
    HighCVE-2026-48763

    baptisteArno Typebot.io: Missing Authorization

    		8.2
    HighCVE-2026-47704

    baptisteArno Typebot.io: Authorization Bypass Through User-Controlled Key

    		—
    CriticalCVE-2026-33712

    TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls

    		10.0
    HighCVE-2026-62865

    TypeBot: Arbitrary server file read via Send Email block attachment path

    		—
    CriticalCVE-2026-47702

    TypeBot API tokens stored in plaintext

    		—
    HighCVE-2026-48767

    Google Sheets OAuth access token disclosure to guest members via getAccessToken

    		7.6
    HighCVE-2026-48766

    TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl

    		7.6
    CriticalCVE-2024-30264

    typebot.io: `GHSL-2024-040`

    also in 1 other product

    		8.1
    HighCVE-2026-48494

    baptisteArno Typebot.io: Authorization Bypass Through User-Controlled Key

    		—
    CriticalCVE-2026-48768

    TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName

    		9.3
    HighCVE-2026-49213

    TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution

    		8.1
    CriticalCVE-2025-64709

    Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

    also in 1 other product

    		9.6
    MediumCVE-2026-62861

    TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain

    		—
    HighCVE-2026-42142

    baptisteArno Typebot.io: Missing Authorization

    		7.1
    HighCVE-2026-48764

    TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass

    		8.2
    HighCVE-2026-48495

    baptisteArno Typebot.io: Missing Authorization

    		7.1
    HighCVE-2026-28445

    Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview

    		8.7
    HighCVE-2026-39970

    TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form

    		—
    HighCVE-2026-39965

    TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks

    		7.7
    HighCVE-2026-34207

    TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation

    		7.6
    HighCVE-2025-65098

    Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

    also in 1 other product

    		7.4
    HighCVE-2026-39968

    TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint

    		7.1

    All vulnerabilities in search

    News

    All products by Baptistearno