CVE-2025-64706

Typebot before version 3.13.2 allows client-side script execution that can steal all stored credentials from any user. When a victim previews a malicious typebot, JavaScript executes in their browser and exfiltrates OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership.

Typebot up to version 3.17.1 (self-hosted) has a brute-force vulnerability in the default passwordless email magic-link authentication. The code is generated using Math.random() and has only 900,000 possible combinations, with no attempt limits or lockouts, allowing account takeover. An attacker knowing the victim's email address can gain full access without victim interaction.

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.

TypeBot version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.

TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.

TypeBot is a chatbot builder tool that in versions 3.16.1 and earlier has an unauthenticated endpoint for generating upload URLs. This allows anonymous users to upload malicious HTML, SVG, or JS files, potentially leading to stored XSS.

SQL injection in the 'two_steps_auth_code' parameter processed by the 'twoStepsAuthVerification' function in the '/user-login' endpoint. The 2FA functionality is accessible without authentication, allowing unauthenticated attackers to execute arbitrary SQL queries. Successful exploit can lead to database enumeration, unauthorized creation of privileged users, modification or deletion of critical information, and denial of service.

Typebot versions 3.15.2 and prior have an SSRF vulnerability in the preview chat endpoint. An unauthenticated attacker can supply a custom typebot definition with server-side code, bypassing SSRF validation and making network requests from the server.

Typebot, an open-source chatbot builder, in versions prior to 3.13.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the webhook block (HTTP Request component). Authenticated users can make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.

Typebot in self-hosted versions prior to 3.18.0 has a vulnerability in the Send Email integration block that allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from typebot variables, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL. The Nodemailer transport is created without disabling file access, so an attachment specified as an absolute server path is read from the local filesystem and delivered.