How many CVEs have a located fix in baptisteArno/typebot.io?

26 published CVEs have a fix traced to functions in baptisteArno/typebot.io, touching 40 functions across 92 files.

Which function in baptisteArno/typebot.io has been patched by the most CVEs?

route in packages/blocks/fileInput/src/api/router.ts has been changed by 3 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in baptisteArno/typebot.io?

The median fix changes 71 lines. 27% of fixes change 20 lines or fewer, and 23% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

sql

#191 of 500 repositories

baptisteArno/typebot.io

Name: baptisteArno/typebot.io: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 25, 2026

26

CVE fixes located

Published CVEs

40

Functions patched

Distinct function sites

92

Files patched

Distinct source files

2024–2026

Years covered

By CVE publication date

Overview

26 published CVEs have a fix traced to functions in baptisteArno/typebot.io, the earliest published in 2024. Those fixes changed 40 distinct functions across 92 files, in 505 patch hunks.

Among the 500 repositories tracked here, baptisteArno/typebot.io ranks #191 by the number of CVEs with a located fix.

Most patched functions

Functions in baptisteArno/typebot.io changed by the most CVE fixes.

Most patched files

Files in baptisteArno/typebot.io changed by the most CVE fixes.

1apps/builder/src/features/credentials/api/handleUpdateOAuthCredentials.ts5 CVEs · 0 functions
2packages/blocks/fileInput/src/api/router.ts3 CVEs · 1 functions
3packages/lib/src/s3/deprecated/generatePresignedUrl.ts3 CVEs · 1 functions
4apps/builder/src/features/blocks/integrations/googleSheets/api/handleGetAccessToken.ts3 CVEs · 0 functions
5apps/builder/src/features/blocks/integrations/openai/api/handleListModels.ts3 CVEs · 0 functions
6packages/blocks/fileInput/src/api/deprecated/handleGetUploadUrl.ts3 CVEs · 0 functions
7apps/builder/src/features/blocks/integrations/googleSheets/api/router.ts2 CVEs · 2 functions
8apps/builder/src/features/blocks/integrations/googleSheets/api/googleSheetsOAuthState.ts2 CVEs · 1 functions
9apps/builder/src/features/credentials/api/getOAuthBlockDefinition.ts2 CVEs · 1 functions
10apps/builder/src/features/templates/components/TemplatesDialog.tsx2 CVEs · 1 functions

Fix size

How much code a CVE fix in baptisteArno/typebot.io changes, with backports counted once.

71

Median lines changed

Added plus removed, per CVE

27%

Fixes of 20 lines or fewer

Share of CVE fixes

23%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in baptisteArno/typebot.io, and the functions each fix changed.

TypeBot: Arbitrary server file read via Send Email block attachment path
CVE-2026-62865Mail
High · CVSS 8.7
EPSS 0.3%2026-08-25
TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain
CVE-2026-62861
Medium · CVSS 6.4
EPSS 0.4%2026-08-25
TypeBot: Account takeover via brute-forceable 6-digit magic-link code
CVE-2026-62862VerificationTokenWhere defineConfig createVerificationToken
Critical · CVSS 9.1
EPSS 0.5%2026-08-25
TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath
CVE-2026-48763GeneratePresignedUrlProps route
High · CVSS 8.2
EPSS 0.5%2026-08-11
TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler
CVE-2026-48762toString OpenAI ExtendedRequestInit
Medium · CVSS 5.4
EPSS 0.3%2026-08-11
TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding
CVE-2026-48765GeneratePresignedUrlProps route
Critical · CVSS 9.9
EPSS 0.5%2026-08-11
TypeBot vulnerable to CSV injection in result export
CVE-2026-47705TimeFilter
Critical · CVSS 9.6
EPSS 0.6%2026-08-11
Google Sheets OAuth access token disclosure to guest members via getAccessToken
CVE-2026-48767object ForgedBlockDefinition postMessage
High · CVSS 7.6
EPSS 0.4%2026-08-11
TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids
CVE-2026-48494string object
High · CVSS 7.1
EPSS 0.5%2026-08-11
TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session
CVE-2026-47704
High · CVSS 7.1
EPSS 0.6%2026-08-11
TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
CVE-2026-48483
Medium · CVSS 5.4
EPSS 0.3%2026-08-11
TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots
CVE-2026-48495object ForgedBlockDefinition postMessage
High · CVSS 7.1
EPSS 0.4%2026-08-11

Get an alert for each new baptisteArno/typebot.io CVE, with the patched functions and AI-written analysis.

Monitor typebot.io CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

danny-avila/librechat26 CVEs firefly-iii/firefly-iii26 CVEs getkirby/kirby26 CVEs LibVNC/libvncserver26 CVEs mdadams/jasper26 CVEs moby/moby26 CVEs muttmua/mutt26 CVEs osTicket/osTicket26 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in baptisteArno/typebot.io.

How many CVEs have a located fix in baptisteArno/typebot.io?: 26 published CVEs have a fix traced to functions in baptisteArno/typebot.io, touching 40 functions across 92 files.
Which function in baptisteArno/typebot.io has been patched by the most CVEs?: route in packages/blocks/fileInput/src/api/router.ts has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in baptisteArno/typebot.io?: The median fix changes 71 lines. 27% of fixes change 20 lines or fewer, and 23% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track baptisteArno/typebot.io CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing