CVE-2026-48483

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description The WhatsApp status forwarding feature allows a workspace user to configure a webhook forwarding URL. The server subsequently sends POST requests containing WhatsApp marketing or error status events to this URL. Because the system uses a raw ky instance instead of the SSRF-protected safeKy client, the URL is not properly restricted. This allows an attacker to trigger HTTP requests from the server to internal services, private-network hosts, localhost, or metadata-style endpoints. SSRF (Server-Side Request Forgery) is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update to version 3.17.0.