CVE-2026-34207

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0.

• CWE-20
• CWE-918

• https://github.com/baptisteArno/typebot.io/commit/23818bb0e54db23c456ee3fa6b12d82b2af848b8
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grcc-6x37-wwgp
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grcc-6x37-wwgp

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34200Nhost is an open source Firebase alternative with GraphQL. P…7.5
• CVE-2026-34202ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-34203Nautobot is a Network Source of Truth and Network Automation…4.3
• CVE-2026-34204MinIO is a high-performance object storage system. Prior to …7.1
• CVE-2026-34205Home Assistant is open source home automation software that …9.6
• CVE-2026-34206Captcha Protect is a Traefik middleware to add an anti-bot c…6.1
• CVE-2026-34208SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…10
• CVE-2026-34209mppx is a TypeScript interface for machine payments protocol…7.5
• CVE-2026-34210mppx is a TypeScript interface for machine payments protocol…8.1
• CVE-2026-34211SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…7.5
• CVE-2026-34212Docmost is open-source collaborative wiki and documentation …5.4
• CVE-2026-34213Docmost is open-source collaborative wiki and documentation …5.4