CVE-2026-47705: TypeBot CSV Injection Vulnerability

CVE-2026-47705 Overview

CVE-2026-47705 is a CSV injection vulnerability in TypeBot, an open-source chatbot builder tool. Version 3.16.1 fails to sanitize or escape user-supplied input when generating CSV files from the result export functionality. Attackers can inject spreadsheet formulas into chatbot input fields, which execute when an administrator opens the exported CSV in Microsoft Excel or LibreOffice Calc. The issue is tracked under [CWE-1236] (Improper Neutralization of Formula Elements in a CSV File) and was fixed in version 3.17.0.

Critical Impact
Formula injection through exported CSV files enables arbitrary command execution on administrator workstations when opened in spreadsheet software, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

TypeBot version 3.16.1
TypeBot versions prior to 3.17.0
Deployments using the result export functionality

Discovery Timeline

2026-08-11 - CVE-2026-47705 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-47705

Vulnerability Analysis

The vulnerability resides in TypeBot's result export functionality, specifically in the components that generate CSV files from collected chatbot responses. The affected files include apps/builder/src/features/results/components/table/ExportAllResultsDialog.tsx and apps/builder/src/features/results/components/table/SelectionToolbar.tsx. Neither component sanitized cell content before writing user-submitted values to CSV output.

An attacker interacts with a public chatbot form and submits values that begin with formula trigger characters such as =, +, -, @, or tab and carriage return characters. These values are stored as normal string responses. When an administrator later exports results and opens the file, the spreadsheet application interprets the leading character as a formula and executes it. Formulas can invoke DDE, HYPERLINK, WEBSERVICE, or IMPORTXML primitives to exfiltrate data or launch external processes.

Root Cause

The root cause is missing output encoding for CSV cells. TypeBot treated user-controlled response data as safe string content and wrote it directly to the export stream. No prefix escaping (for example, prepending a single quote or wrapping in quotes with escape handling) was applied before serialization.

Attack Vector

Exploitation requires no authentication on the chatbot itself. The attacker submits a crafted response to any published TypeBot form, then waits for an administrator to export and open the results. Because execution occurs in the administrator's spreadsheet context with an authenticated session and local privileges, scope changes from the web application to the operator workstation.

text

// Patch: apps/builder/src/features/results/components/table/ExportAllResultsDialog.tsx
 import { parseBlockIdVariableIdMap } from "@typebot.io/results/parseBlockIdVariableIdMap";
 import { parseColumnsOrder } from "@typebot.io/results/parseColumnsOrder";
 import { parseResultHeader } from "@typebot.io/results/parseResultHeader";
+import { sanitizeCsvCell } from "@typebot.io/results/sanitizeCsvCell";
 import {
   type TimeFilter,
   timeFilterLabels,

// Patch: apps/builder/src/features/results/components/table/SelectionToolbar.tsx
 import { parseUniqueKey } from "@typebot.io/lib/parseUniqueKey";
 import { byId } from "@typebot.io/lib/utils";
 import { parseColumnsOrder } from "@typebot.io/results/parseColumnsOrder";
+import { sanitizeCsvCell } from "@typebot.io/results/sanitizeCsvCell";
 import { AlertDialog } from "@typebot.io/ui/components/AlertDialog";

Source: GitHub commit 89682dd. The fix introduces a new sanitizeCsvCell helper applied to both export paths.

Detection Methods for CVE-2026-47705

Indicators of Compromise

TypeBot form submissions containing values beginning with =, +, -, @, tab, or carriage return characters
Exported CSV files from /results/export endpoints containing DDE, HYPERLINK, WEBSERVICE, IMPORTXML, or cmd| strings
Outbound network connections from EXCEL.EXE or soffice.bin to unfamiliar domains shortly after a results export
Child processes such as cmd.exe, powershell.exe, or wscript.exe spawned by spreadsheet applications

Detection Strategies

Inspect chatbot response databases for entries starting with formula trigger characters before allowing exports
Alert on process creation where the parent is a spreadsheet application and the child is a shell or scripting interpreter
Monitor endpoint telemetry for EXCEL.EXE or soffice.bin initiating outbound HTTP/HTTPS connections

Monitoring Recommendations

Log and review all administrative uses of the TypeBot results export feature
Retain CSV export artifacts for retrospective inspection when new indicators emerge
Track TypeBot instance versions across the environment and flag any still running 3.16.1 or earlier

How to Mitigate CVE-2026-47705

Immediate Actions Required

Upgrade TypeBot to version 3.17.0 or later, which introduces the sanitizeCsvCell helper on both export code paths
Restrict access to the results export functionality to trusted administrators only
Instruct operators to open exported CSV files in a text editor or sandboxed viewer before loading them in a spreadsheet application

Patch Information

The fix is delivered in TypeBot release v3.17.0 via pull request #2493 and commit 89682dd4ad56f33263332fa377beb01ad616c27c. Full details are published in the GitHub Security Advisory GHSA-p52m-h5qg-8p8w.

Workarounds

Disable Dynamic Data Exchange (DDE) in Microsoft Excel through the Trust Center settings
Configure LibreOffice Calc to disable macro execution and external references by default
Pre-process exported CSV files with a script that prepends a single quote to any cell beginning with =, +, -, or @

bash

# Sanitize an exported CSV by prefixing formula trigger cells with a single quote
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++) if($i ~ /^[=+\-@\t\r]/) $i="'\''" $i; print}' results.csv > results.sanitized.csv