CVE-2026-47705

TypeBot version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.

The risk is that an administrator may accidentally execute malicious formulas in a spreadsheet, which could lead to data leakage or further system compromise. The attack requires administrator interaction but can be used for data theft or malware propagation.

It is recommended to immediately upgrade TypeBot to version 3.17.0 or later. Additionally, administrators should be cautious when opening CSV files from untrusted sources and consider using software that does not execute formulas automatically.