TypeBot version 3.16.1 allows CSV injection in the result export module, enabling attackers to insert spreadsheet formulas into user-provided input fields. When an administrator later opens the generated CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc, these formulas are evaluated and can cause arbitrary code execution or data leakage, falling under CWE-1236. The vulnerability itself does not break out of the application, but it can be abused by a malicious actor to run unintended functions within the victim’s spreadsheet environment.

The affected product is TypeBot, a chatbot builder tool developed by baptisteArno. Vulnerable releases include version 3.16.1 and earlier; the issue is resolved in version 3.17.0.

The CVSS base score of 9.6 indicates critical severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time, and the vulnerability is currently not listed in CISA KEV. Exploitation requires an attacker to supply malicious input that is then exported to CSV and must be opened by an administrator; thus the attack vector is an indirect user interaction. If an administrator opens the CSV without suspicion, injected formulas will execute, potentially exposing proprietary data or allowing for further system compromise. The lack of sanitization during CSV generation is the root weakness. Given the critical CVSS score, mitigation should be prioritized even though the current exploit probability is low.