CVE-2026-48483

MEDIUM 5.4

TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.

CWE	CWE-918
Vendor	baptistearno
Product	typebot.io
Published	Aug 11, 2026
Last Updated	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for baptistearno typebot.io

Be the first to know when new medium vulnerabilities affecting baptistearno typebot.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

baptisteArno / typebot.io

< 3.17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx github.com: https://github.com/baptisteArno/typebot.io/pull/2497 github.com: https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c github.com: https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0