CVE-2026-48483

{
  "id": "CVE-2026-48483",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T17:18:02.067",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "TypeBot es una herramienta de creación de chatbots. Antes de la versión 3.17.0, la función de reenvío de estado de WhatsApp de Typebot almacena una URL de reenvío de webhook configurada por el espacio de trabajo y posteriormente envía eventos de estado de marketing/error de WhatsApp a ella desde el servidor. La URL almacenada solo se valida como una URL genérica en la configuración, pero el código de reenvío utiliza la instancia ’ky’ sin procesar en lugar del cliente ’safeKy’ protegido contra SSRF del repositorio. Un usuario del espacio de trabajo que puede configurar los ajustes de WhatsApp puede, por lo tanto, hacer que el servidor de Typebot emita solicitudes HTTP a servicios internos, hosts de red privada, localhost o puntos finales de estilo metadatos cada vez que el webhook de producción público de WhatsApp reciba una carga útil de estado que deba ser reenviada. La versión 3.17.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "baptisteArno",
          "product": "typebot.io",
          "versions": [
            {
              "version": "< 3.17.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T18:34:06.275082Z",
          "id": "CVE-2026-48483",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/pull/2497",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}