Server-Side Request Forgery Vulnerability in TypeBot Chatbot Builder by Baptiste Arno

CVE-2026-48764

What is CVE-2026-48764?

TypeBot, a chatbot builder by Baptiste Arno, is affected by a server-side request forgery (SSRF) vulnerability in versions prior to 3.17.2. The flaw arises from a failure in validating outbound requests due to a time-of-check to time-of-use gap. Initially, a hostname is resolved and checked against a forbidden range; however, this validation can be bypassed via DNS rebinding. An attacker can exploit this vulnerability by supplying a URL to a public bot, enabling unauthorized access to internal network services or metadata endpoints. This could lead to serious consequences such as the exposure of sensitive metadata, unauthorized access to internal admin panels, and potential credential theft from internal services. The issue has been addressed in version 3.17.2.

References