Executive brief
TypeBot, a chatbot builder tool, contains a security flaw that allows users with workspace editing permissions to bypass internal network protections. By using a specific network address format (IPv6 unspecified address), an attacker can force the TypeBot server to connect to internal services that are normally restricted. This could lead to the exposure of sensitive internal data or unauthorized access to other systems running on the same local network as the TypeBot server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in TypeBot's URL validation logic within `packages/lib/src/ssrf/validateHttpReqUrl.ts`. While the `validateIPAddress` function explicitly blocks various sensitive ranges (loopback, link-local, private IPv4, and IPv6 loopback), it fails to account for the IPv6 unspecified address `::` (or its expanded form `0:0:0:0:0:0:0:0`). In Node.js environments, a request to `http://[::]:<port>/` can successfully reach local services listening on the IPv6 wildcard address. An attacker with workspace editor or creator privileges can exploit this by configuring a server-side HTTP Request block or a guarded script fetch to probe or interact with internal HTTP services. This bypass affects the `safeKy` utility and can be triggered via public chat API endpoints such as `/v1/typebots/{publicId}/startChat`. The issue is resolved in version 3.17.2 by adding `::` to the blocked address list.
Affected products
- baptisteArno typebot.io < 3.17.2
Timeline
- 2026-05-24: patched: Fix merged into main branch via PR #2511
- 2026-06-17: advisory: Release v3.17.2 published
- 2026-06-27: advisory: GitHub Security Advisory GHSA-qx46-p88f-xxm3 published
- 2026-07-10: disclosed: CVE-2026-49213 published to NVD