CVE-2026-33712

creationtimestamp| type| source ---|---|--- 2026-05-25 17:00:04+00:00| seen| https://t.me/GithubRedTeam/85856 2026-05-25 19:00:11+00:00| seen| Telegram/u353QQC82id8CE3exVt8JuaCPTA2e4vaac9ku63kUT5lYfk 2026-05-25 21:00:04+00:00| seen| Telegram/DE8V0W55Lks0xFUNDp9UGyNB0T-CRSwfpeIrdYc5V2Tnj4...

CVE-2026-33712 TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint POST /api/v1/typebots/typebotId/preview/startChat allows unauthenticated users to achieve Server-Side Request Forgery SSRF by supplying a custom typebot definition with server-side code blocks. The fetch...