What is CVE-2025-64709?

CVE-2025-64709 is a critical-severity vulnerability in Baptistearno Typebot.io, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.6/10. Published 2025-11-13.

How severe is CVE-2025-64709?

Critical severity. CVSS v3 base score is 9.6 out of 10.

SSRF in Baptistearno Typebot.io

CVE-2025-64709

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.004 (29.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.

Affected products

Baptistearno Typebot.io — versions < 3.13.1
Typebot

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2025-64709?: CVE-2025-64709 is a critical-severity vulnerability in Baptistearno Typebot.io, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.6/10. Published 2025-11-13.
How severe is CVE-2025-64709?: Critical severity. CVSS v3 base score is 9.6 out of 10.