CVE-2026-48762

{
  "id": "CVE-2026-48762",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T21:17:36.677",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI \"Create Transcription\" action handler fetches a user-supplied audio URL using `fetch()` without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitrary internal addresses and localhost. The fetched content is passed to the OpenAI Whisper API and the transcription result is returned to the attacker. Version 3.16.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "TypeBot es una herramienta de creación de chatbots. Antes de la versión 3.16.0, el gestor de acciones ’Create Transcription’ de OpenAI obtiene una URL de audio proporcionada por el usuario usando “fetch()” sin aplicar la protección SSRF que existe en otras partes de la base de código. Un atacante puede dirigir al servidor para realizar solicitudes HTTP a direcciones internas arbitrarias y a localhost. El contenido obtenido se pasa a la API de OpenAI Whisper y el resultado de la transcripción se devuelve al atacante. La versión 3.16.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "baptisteArno",
          "product": "typebot.io",
          "versions": [
            {
              "version": "< 3.16.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T15:09:57.620407Z",
          "id": "CVE-2026-48762",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/baptisteArno/typebot.io/commit/a33051755f9e734596498851d5f61bd2e171f192",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/pull/2428",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-h3v3-c6cq-q763",
      "source": "[email protected]"
    }
  ]
}