SSRF Vulnerability in TypeBot Chatbot Builder Tool by Baptiste Arno

CVE-2026-48762

What is CVE-2026-48762?

TypeBot, a powerful chatbot builder tool, has a vulnerability that allows an attacker to exploit the OpenAI 'Create Transcription' action handler. In versions prior to 3.16.0, the handler fetches user-supplied audio URLs using the fetch() method without adequate SSRF protection. This flaw permits attackers to force the server to make HTTP requests to any internal addresses, including localhost. The content retrieved can be sent to the OpenAI Whisper API, allowing the attacker to obtain the transcription results. Version 3.16.0 addresses and resolves this vulnerability.

References