CVE-2026-48483

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48483", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-21T15:33:08.291Z", "datePublished": "2026-08-11T16:21:21.369Z", "dateUpdated": "2026-08-11T18:34:40.277Z"}, "containers": {"cna": {"title": "TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx"}, {"name": "https://github.com/baptisteArno/typebot.io/pull/2497", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/pull/2497"}, {"name": "https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c"}, {"name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0"}], "affected": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"version": "< 3.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T16:21:21.369Z"}, "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue."}], "source": {"advisory": "GHSA-5c92-7q58-4rgx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T18:34:06.275082Z", "id": "CVE-2026-48483", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T18:34:40.277Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48483", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T18:34:06.275082Z"}}}], "references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T18:34:25.967Z"}}], "cna": {"title": "TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server", "source": {"advisory": "GHSA-5c92-7q58-4rgx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "baptisteArno", "product": "typebot.io", "versions": [{"status": "affected", "version": "< 3.17.0"}]}], "references": [{"url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx", "name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/baptisteArno/typebot.io/pull/2497", "name": "https://github.com/baptisteArno/typebot.io/pull/2497", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c", "name": "https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T16:21:21.369Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48483", "state": "PUBLISHED", "dateUpdated": "2026-08-11T18:34:40.277Z", "dateReserved": "2026-05-21T15:33:08.291Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-11T16:21:21.369Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "typebot.io", "vendor": "baptisteArno", "versions": [{"status": "affected", "version": "< 3.17.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue."}, {"lang": "es", "value": "TypeBot es una herramienta de creaci\u00f3n de chatbots. Antes de la versi\u00f3n 3.17.0, la funci\u00f3n de reenv\u00edo de estado de WhatsApp de Typebot almacena una URL de reenv\u00edo de webhook configurada por el espacio de trabajo y posteriormente env\u00eda eventos de estado de marketing/error de WhatsApp a ella desde el servidor. La URL almacenada solo se valida como una URL gen\u00e9rica en la configuraci\u00f3n, pero el c\u00f3digo de reenv\u00edo utiliza la instancia \u2019ky\u2019 sin procesar en lugar del cliente \u2019safeKy\u2019 protegido contra SSRF del repositorio. Un usuario del espacio de trabajo que puede configurar los ajustes de WhatsApp puede, por lo tanto, hacer que el servidor de Typebot emita solicitudes HTTP a servicios internos, hosts de red privada, localhost o puntos finales de estilo metadatos cada vez que el webhook de producci\u00f3n p\u00fablico de WhatsApp reciba una carga \u00fatil de estado que deba ser reenviada. La versi\u00f3n 3.17.0 corrige el problema."}], "id": "CVE-2026-48483", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48483", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T18:34:06.275082Z", "version": "2.0.3"}}]}, "published": "2026-08-11T17:18:02.067", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/pull/2497"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.17.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "typebot.io", "source": "cna", "vendor": "baptisteArno"}, "product": "typebot.io", "vendor": "baptistearno"}], "created": "2026-08-12T20:45:08.816604+00:00", "updated": "2026-08-13T04:30:06.139249+00:00", "vendors": ["baptistearno", "baptistearno$PRODUCT$typebot.io"]}