Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-47705TypeBot vulnerable to CSV injection in result export

Critical 9.6

In plain English

A critical-severity security flaw in typebot.io from baptisteArno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.6%top 53.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
baptisteArno	typebot.io	= 3.16.1

Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-p52m-h5qg-8p8w x_refsource_CONFIRM
https://github.com/baptisteArno/typebot.io/pull/2493 x_refsource_MISC
https://github.com/baptisteArno/typebot.io/commit/89682dd4ad56f33263332fa377beb01ad616c27c x_refsource_MISC
https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0 x_refsource_MISC