CVE-2026-47705

Received Received - Intake

CSV Injection in TypeBot Result Export

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-47705

EUVD

EUVD-2026-56783

Affected Vendors & Products

Vendor	Product	Version / Range
baptistearno	typebot	3.16.1
baptistearno	typebot	3.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1236	The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

Executive Summary

CVE-2026-47705 is a CSV injection vulnerability in TypeBot versions 3.16.1 and earlier. It occurs in the result export feature where user input is directly written to CSV files without sanitization. Attackers can inject spreadsheet formulas (e.g., =cmd|' /C calc'!A0) into input fields. When an administrator opens the CSV in software like Excel, these formulas execute, enabling remote code execution or data theft. The vulnerability requires no authentication and has a CVSS score of 9.6 (Critical).

Detection Guidance

To detect this vulnerability, check if your TypeBot instance is running version 3.16.1 or earlier. Inspect exported CSV files for suspicious formulas starting with =, +, -, or @. Test input fields by injecting payloads like =cmd|' /C calc'!A0 and verify if they appear unescaped in CSV exports.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands or steal sensitive data when an administrator opens a malicious CSV file. Since it targets public input fields, no authentication is needed for exploitation. Attackers could gain control over the system running the spreadsheet software or exfiltrate confidential information stored in the CSV.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting personal and health data. Unauthorized access to exported data may result in non-compliance, legal penalties, and reputational damage. Organizations using affected TypeBot versions must patch to avoid regulatory violations.

Mitigation Strategies

Immediately upgrade to TypeBot version 3.17.0 or later. If upgrading is not possible, implement server-side CSV sanitization by prefixing dangerous values with a single quote. Disable CSV export functionality temporarily if no alternative exists.

Hi! I’m here to help you understand CVE-2026-47705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70