Skip to content
OpenAdvisories

Package · npm

@typebot.io/js

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-28445

    Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview

    Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg field directly via Solid's innerHTML directive without any sanitization, even though DOMPurify is alrea…

    baptisteArno typebot.io @typebot.io/js npm
  • High 7.4
    CVE-2025-65098

    Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

    Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their br…

    baptisteArno typebot.io @typebot.io/js npm