CVE-2025-64709 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

CVE-2025-64709 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

CVE-2025-64709

Typebot (open-source chatbot builder) contains an SSRF flaw in the webhook block’s HTTP Request component affecting versions before 3.13.1. The issue lets authenticated users cause server-side HTTP requests, bypass IMDSv2 via custom header injection, and extract temporary AWS IAM credentials for ...

CVE-2025-12967

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS users. We recommend customers...

Malicious code in bitsight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee657cb65d10490f2b29546c27133e3049eab717c2b57bda3029643665e32899 The package bitsight was found to contain malicious code...

MAL-2025-190492 Malicious code in worldskills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d245ace818f9e6d4526355bd80129354c139dd0b991e6df6ee6211df41110352 The package worldskills was found to contain malicious code...

MAL-2025-190490 Malicious code in bitsight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee657cb65d10490f2b29546c27133e3049eab717c2b57bda3029643665e32899 The package bitsight was found to contain malicious code...

Malicious code in worldskills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d245ace818f9e6d4526355bd80129354c139dd0b991e6df6ee6211df41110352 The package worldskills was found to contain malicious code...

Malicious code in enum-report-char-rho-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75fe47f9adba20f092284e704a6a5619427390e0fff83d48dab8122cbd9ecac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187335 Malicious code in hercules-deimos-superagent-webdriverio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d98d6bdee6ef3106d12f87df57e1e2b9c3528bfbddfd348a03903227af37f81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in compile-validate-sandbox-node-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdc4473c74d323ab1478cebfa6f67c5738a3dc065c1c5261534dc58cc730cb86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pulsar-selenium-oortcloud-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b9c392f64679172f81a2fc6e79ccf979dfbf3879ed0696eb339f8e1a4219167 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Typebot 代码问题漏洞

Typebot is an open source chatbot builder by the individual developer Baptiste Arnaud. A code issue vulnerability exists in versions prior to Typebot 3.13.1 that stems from a server-side request forgery in the Typebot webhook block functionality, which could lead to the extraction of AWS IAM...

PT-2025-46903

Name of the Vulnerable Software and Affected Versions Typebot versions prior to 3.13.1 Description Typebot is an open-source chatbot builder. A Server-Side Request Forgery SSRF issue exists in the Typebot webhook block HTTP Request component functionality. This allows authenticated users to make...

Malicious code in mitouko-on-lakoik (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbb0921edaca69d1f0782e2c02410f57cf1ab59683e9cf2d3b7801f320e23b10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-dci-rsyyt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68f63358138fef49fc0efee7a663967c40680ea7cfcea40180405afe9991a8d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mitk-oni-lapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 442cf9b9d9819fd1b22746e0deb7967eaf955d6fce7845db2fd1fc8295204f9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183008 Malicious code in itale-dci-rfsrgget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f45d70193b40ea108ab268cf1c51a7b22ec4ba83cbc25eeaa244a8358683117 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185339 Malicious code in unise-kit-bogavotaawfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3410b120e2ae4965125c564ee09b3d36062988c478d1de2bdffc4d4b7d4d1722 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso66 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2994e50808305049a3ed4646e9b50d3633e7a856598ada14ed9983d993d858c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...