Executive brief
Typebot is an open-source chatbot builder used to create conversational interfaces. A security flaw in the chat preview feature allows unauthorized individuals to force the server to make requests to internal systems. This could allow an attacker to steal cloud service credentials, access private internal databases, or exfiltrate sensitive operational data, potentially leading to a full compromise of the hosting environment.
Technical details
A critical vulnerability exists in Typebot's preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) due to a combination of missing authorization and insufficient input validation. The `getTypebot` function in the bot engine skips authentication checks when a custom typebot object is provided in the request. Furthermore, the `fetch` function exposed within the `isolated-vm` sandbox environment lacks the `validateHttpReqUrl` checks used elsewhere in the application. An unauthenticated attacker can submit a crafted typebot definition containing server-side code blocks that use this unrestricted `fetch` to access internal network resources or cloud metadata services (e.g., AWS IMDS). This bypasses previous SSRF mitigations and has been addressed in version 3.16.0.
Affected products
- baptisteArno typebot.io <= 3.15.2
Timeline
- 2026-04-08: patched: Version 3.16.0 released
- 2026-05-22: disclosed: GitHub Security Advisory published
- 2026-05-22: advisory: NVD published CVE-2026-33712