{"data":{"id":"30a6ba2a-e08d-43de-8730-cf414e079085","title":"CVE-2026-48762: TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI \"Create Transcription\" action handler fetches a…","summary":"TypeBot, a chatbot builder tool, prior to version 3.16.0 has a flaw in the OpenAI \"Create Transcription\" action handler. The handler fetches a user-supplied audio URL with `fetch()` without the SSRF protection used elsewhere in the codebase, so an attacker can make the server send HTTP requests to arbitrary internal addresses and localhost. The fetched content goes to the OpenAI Whisper API, and the transcription result is returned to the attacker. The weakness is classified as CWE-918.","solution":"Version 3.16.0 fixes the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48762","publishedAt":"2026-08-11T21:17:36.677Z","cveId":"CVE-2026-48762","cweIds":["CWE-918"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["TypeBot","OpenAI Whisper API","OpenAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TypeBot OpenAI transcription action server-side request forgery via audio URL","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00304,"epssCheckedAt":"2026-11-11T00:13:31.420Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T06:14:07.494Z","patchAvailable":null,"disclosureDate":"2026-08-11T21:17:36.677Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}