CVE-2026-47705

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description The result export functionality fails to sanitize or escape user-supplied input when generating CSV files. This allows an attacker to inject spreadsheet formulas into input fields. These formulas are executed when an administrator opens the exported CSV file using spreadsheet software like Microsoft Excel or LibreOffice Calc. CSV injection is a technique where malicious formulas are inserted into a CSV file to execute commands or steal data when opened in a spreadsheet application.

Recommendations Update to version 3.17.0.