PT-2025-46903 · Typebot · Typebot

Published 2025-11-13 · Updated 2026-01-30 · CVE-2025-64709

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Typebot versions prior to 3.13.1

Description Typebot is an open-source chatbot builder. A Server-Side Request Forgery (SSRF) issue exists in the Typebot webhook block (HTTP Request component) functionality. This allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, potentially leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure.

Recommendations Update Typebot to version 3.13.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-64709

GHSA-8GQ9-RW7V-3JPR

Affected Products

Typebot

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64709.json · Exploit
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8gq9-rw7v-3jpr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64709 · Security Note
• https://t.me/poxek/5676 · Telegram Post
• https://t.me/CVEtracker/37281 · Telegram Post
• https://t.me/cveNotify/150396 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989225337696182398 · Twitter Post