Skip to content
OpenAdvisories

Package · npm

@typebot.io/js

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.4
    CVE-2026-39964

    TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers

    TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, whic…

    baptisteArno typebot.io @typebot.io/js npm
  • High 8.7
    CVE-2026-28445

    Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview

    Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg field directly via Solid's innerHTML directive without any sanitization, even though DOMPurify is alrea…

    baptisteArno typebot.io @typebot.io/js npm
  • High 7.4
    CVE-2025-65098

    Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

    Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their br…

    baptisteArno typebot.io @typebot.io/js npm