Skip to content
OpenAdvisories

Package · npm

@typebot.io/js

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2026-39964

    TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers

    TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, whic…

    baptisteArno typebot.io @typebot.io/js npm