CVE-2026-47705

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.

• CWE-1236

• https://github.com/baptisteArno/typebot.io/commit/89682dd4ad56f33263332fa377beb01ad616c27c
• https://github.com/baptisteArno/typebot.io/pull/2493
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-p52m-h5qg-8p8w
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-p52m-h5qg-8p8w

Published

Aug 11, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47699Confidential Containers Guest Components provides guest tool…6.4
• CVE-2026-4770Improper neutralization of input during web page generation …4.6
• CVE-2026-47701The OpenTelemetry Operator is a Kubernetes Operator for the …7.7
• CVE-2026-47702TypeBot is a chatbot builder tool. In version 3.16.1, API to…9.1
• CVE-2026-47703AdGuard Home is a network-wide software for blocking ads and…5.3
• CVE-2026-47704TypeBot is a chatbot builder tool. Prior to version 3.17.0, …7.1
• CVE-2026-47706Strawberry GraphQL is a library for creating GraphQL APIs. I…5.3
• CVE-2026-47707Strawberry GraphQL is a library for creating GraphQL APIs. I…5.3
• CVE-2026-47708MCP-for-Stata is an MCP server for Stata to integrate Stata …9.3
• CVE-2026-47709libheif is a HEIF and AVIF file format decoder and encoder. …5.5
• CVE-2026-47712Dulwich is a pure-Python implementation of the Git file form…3.3
• CVE-2026-47713AnythingLLM is an application that turns pieces of content i…4.3