CVE-2026-49213

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.2

Description A Server-Side Request Forgery (SSRF) flaw exists in the shared SSRF validator located in packages/lib/src/ssrf/validateHttpReqUrl.ts. The validateIPAddress() function fails to block the IPv6 unspecified address :: or its expanded form, allowing it to bypass restrictions on local, metadata, and private ranges. A workspace editor or creator can exploit this by configuring a server-side HTTP Request block or guarded script fetch to force the server to connect to local HTTP services. This can be triggered via the endpoints 'POST /v1/typebots/{publicId}/startChat' and 'POST /v1/sessions/{sessionId}/continueChat'.

Recommendations Update to version 3.17.2.