CVE-2026-48766 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

PT-2026-70258

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

MAL-2025-3519 Malicious code in @reserach_org_jfhalsdhfkslsfds/openai-client-gadfjgfsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83b090ef236e2ba26297f26404fb943955f719c58a2ae5cdb65e3cbb913f025b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...