# Typebot vulnerabilities Source: https://junglewise.ai/threats/technologies/typebot Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/typebot.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in Typebot: 0 in the last 7 days and 3 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62865, was published on 25 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 26 (4 critical, 0 exploited in the wild) ## About Typebot No-code chatbot builder platform for creating conversational forms and surveys. ## Latest Typebot vulnerabilities - [CVE-2026-62865: Typebot arbitrary local file read via Send Email attachment](https://junglewise.ai/threats/cve-2026-62865-typebot-arbitrary-local-file-read-via-send-email-attachment) (info, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-62862: Typebot email login code brute-force to account takeover](https://junglewise.ai/threats/cve-2026-62862-typebot-email-login-code-brute-force-to-account-takeover) (info, published 25 Aug 2026) - [CVE-2026-62861: TypeBot custom domain deletion authorization bypass](https://junglewise.ai/threats/cve-2026-62861-typebot-custom-domain-deletion-authorization-bypass) (info, CVSS 0, published 25 Aug 2026) - [CVE-2026-48767: TypeBot privilege escalation in Google Sheets integration](https://junglewise.ai/threats/cve-2026-48767-typebot-privilege-escalation-in-google-sheets-integration) (high, CVSS 7.6, published 11 Aug 2026) - [CVE-2026-48494: TypeBot WhatsApp preview webhook authorization bypass](https://junglewise.ai/threats/cve-2026-48494-typebot-whatsapp-preview-webhook-authorization-bypass) (info, published 11 Aug 2026) - [CVE-2026-47705: TypeBot CSV injection in result export](https://junglewise.ai/threats/cve-2026-47705-typebot-csv-injection-in-result-export) (critical, CVSS 9.6, published 11 Aug 2026) - [CVE-2026-48766: TypeBot chatbot builder API key exfiltration via guest access](https://junglewise.ai/threats/cve-2026-48766-typebot-chatbot-builder-api-key-exfiltration-via-guest-access) (high, CVSS 7.6, published 11 Aug 2026) - [CVE-2026-48495: TypeBot Google Sheets OAuth callback privilege escalation](https://junglewise.ai/threats/cve-2026-48495-typebot-google-sheets-oauth-callback-privilege-escalation) (high, CVSS 7.1, published 11 Aug 2026) - [CVE-2026-42142: TypeBot authorization bypass in getSheets endpoint](https://junglewise.ai/threats/cve-2026-42142-typebot-authorization-bypass-in-getsheets-endpoint) (high, CVSS 7.1, published 11 Aug 2026) - [CVE-2026-49213: baptisteArno TypeBot SSRF bypass via IPv6 unspecified address](https://junglewise.ai/threats/cve-2026-49213-baptistearno-typebot-ssrf-bypass-via-ipv6-unspecified-address) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2026-48768: baptisteArno TypeBot unauthenticated S3 object write in generate-upload-url](https://junglewise.ai/threats/cve-2026-48768-baptistearno-typebot-unauthenticated-s3-object-write-in-generate) (critical, CVSS 9.3, published 18 Jun 2026) - [CVE-2026-48764: TypeBot SSRF via DNS rebinding bypass in HTTP request blocks](https://junglewise.ai/threats/cve-2026-48764-typebot-ssrf-via-dns-rebinding-bypass-in-http-request-blocks) (high, CVSS 8.2, published 18 Jun 2026) - [CVE-2026-48759: baptisteArno TypeBot IDOR in theme template handlers](https://junglewise.ai/threats/cve-2026-48759-baptistearno-typebot-idor-in-theme-template-handlers) (high, CVSS 7.1, published 17 Jun 2026) - [CVE-2026-39970: baptisteArno TypeBot stored XSS in profile picture upload](https://junglewise.ai/threats/cve-2026-39970-baptistearno-typebot-stored-xss-in-profile-picture-upload) (info, CVSS 8.5, published 22 May 2026) - [CVE-2026-39969: baptisteArno TypeBot insufficient signature verification in WhatsApp webhook](https://junglewise.ai/threats/cve-2026-39969-baptistearno-typebot-insufficient-signature-verification-in) (medium, CVSS 6.5, published 22 May 2026) - [CVE-2026-39968: TypeBot cross-workspace credential theft in bot-engine preview endpoint](https://junglewise.ai/threats/cve-2026-39968-typebot-cross-workspace-credential-theft-in-bot-engine-preview) (high, CVSS 7.1, published 22 May 2026) - [CVE-2026-39967: baptisteArno TypeBot authorization bypass in bot engine](https://junglewise.ai/threats/cve-2026-39967-baptistearno-typebot-authorization-bypass-in-bot-engine) (low, CVSS 3.1, published 22 May 2026) - [CVE-2026-39966: baptisteArno TypeBot IDOR in getLinkedTypebots API](https://junglewise.ai/threats/cve-2026-39966-baptistearno-typebot-idor-in-getlinkedtypebots-api) (medium, CVSS 6.5, published 22 May 2026) - [CVE-2026-39965: baptisteArno TypeBot SSRF via redirect bypass in HTTP and Code blocks](https://junglewise.ai/threats/cve-2026-39965-baptistearno-typebot-ssrf-via-redirect-bypass-in-http-and-code) (high, CVSS 7.7, published 22 May 2026) - [CVE-2026-39964: baptisteArno TypeBot stored XSS in text bubble links](https://junglewise.ai/threats/cve-2026-39964-baptistearno-typebot-stored-xss-in-text-bubble-links) (medium, CVSS 5.4, published 22 May 2026) - [CVE-2026-34207: baptisteArno TypeBot SSRF in Webhook and HTTP Request blocks](https://junglewise.ai/threats/cve-2026-34207-baptistearno-typebot-ssrf-in-webhook-and-http-request-blocks) (high, CVSS 7.6, published 22 May 2026) - [CVE-2026-33712: baptisteArno Typebot SSRF in preview chat endpoint](https://junglewise.ai/threats/cve-2026-33712-baptistearno-typebot-ssrf-in-preview-chat-endpoint) (critical, CVSS 10, published 22 May 2026) - [CVE-2026-28444: Typebot IDOR in getResultLogs API endpoint](https://junglewise.ai/threats/cve-2026-28444-typebot-idor-in-getresultlogs-api-endpoint) (medium, CVSS 6.5, published 22 May 2026) - [CVE-2025-65098: Typebot credential theft via client-side script execution](https://junglewise.ai/threats/cve-2025-65098-typebot-credential-theft-via-client-side-script-execution) (low, CVSS 3.1, published 22 Jan 2026) - [CVE-2025-64709: Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF)…](https://junglewise.ai/threats/cve-2025-64709-typebot-is-an-open-source-chatbot-builder-in-versions-prior-to-3) (critical, CVSS 9.6, published 13 Nov 2025) ## Most severe Typebot vulnerabilities - [CVE-2026-33712: baptisteArno Typebot SSRF in preview chat endpoint](https://junglewise.ai/threats/cve-2026-33712-baptistearno-typebot-ssrf-in-preview-chat-endpoint) (critical, CVSS 10, published 22 May 2026) - [CVE-2026-47705: TypeBot CSV injection in result export](https://junglewise.ai/threats/cve-2026-47705-typebot-csv-injection-in-result-export) (critical, CVSS 9.6, published 11 Aug 2026) - [CVE-2025-64709: Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF)…](https://junglewise.ai/threats/cve-2025-64709-typebot-is-an-open-source-chatbot-builder-in-versions-prior-to-3) (critical, CVSS 9.6, published 13 Nov 2025) - [CVE-2026-48768: baptisteArno TypeBot unauthenticated S3 object write in generate-upload-url](https://junglewise.ai/threats/cve-2026-48768-baptistearno-typebot-unauthenticated-s3-object-write-in-generate) (critical, CVSS 9.3, published 18 Jun 2026) - [CVE-2026-48764: TypeBot SSRF via DNS rebinding bypass in HTTP request blocks](https://junglewise.ai/threats/cve-2026-48764-typebot-ssrf-via-dns-rebinding-bypass-in-http-request-blocks) (high, CVSS 8.2, published 18 Jun 2026) - [CVE-2026-49213: baptisteArno TypeBot SSRF bypass via IPv6 unspecified address](https://junglewise.ai/threats/cve-2026-49213-baptistearno-typebot-ssrf-bypass-via-ipv6-unspecified-address) (high, CVSS 8.1, published 10 Jul 2026) - [CVE-2026-39965: baptisteArno TypeBot SSRF via redirect bypass in HTTP and Code blocks](https://junglewise.ai/threats/cve-2026-39965-baptistearno-typebot-ssrf-via-redirect-bypass-in-http-and-code) (high, CVSS 7.7, published 22 May 2026) - [CVE-2026-48767: TypeBot privilege escalation in Google Sheets integration](https://junglewise.ai/threats/cve-2026-48767-typebot-privilege-escalation-in-google-sheets-integration) (high, CVSS 7.6, published 11 Aug 2026) - [CVE-2026-48766: TypeBot chatbot builder API key exfiltration via guest access](https://junglewise.ai/threats/cve-2026-48766-typebot-chatbot-builder-api-key-exfiltration-via-guest-access) (high, CVSS 7.6, published 11 Aug 2026) - [CVE-2026-34207: baptisteArno TypeBot SSRF in Webhook and HTTP Request blocks](https://junglewise.ai/threats/cve-2026-34207-baptistearno-typebot-ssrf-in-webhook-and-http-request-blocks) (high, CVSS 7.6, published 22 May 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 3 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Typebot vulnerabilities", https://junglewise.ai/threats/technologies/typebot, 10 November 2026.