Typebot CVE-2026-28445

Attacker must hold a low-privileged authenticated identity in the target Typebot instance (collaborator on a shared workspace, or the ability to publish/share an importable typebot) - this is the PR:L requirement. The victim must perform a UI action (UI:R) by opening or previewing a maliciously crafted typebot inside the builder at builder.typebot.io. The payload must be placed in a Rating input block's customIcon.svg field, which the pre-3.16.0 import sanitizer did not flag as isUnsafe and which RatingButton renders through Solid's innerHTML. Exploitation further depends on the builder origin's CSP permitting 'unsafe-inline', which is the case on the hosted builder.typebot.io and on default self-hosted deployments. Limiting factors: not exploitable against published/embedded end-user-facing bots (the sink is in the builder preview path, not the runtime embed); not exploitable without an authenticated builder account or a victim who imports an attacker-supplied typebot; instances that have hardened CSP to remove 'unsafe-inline' break the script-execution step.

The CVSS 8.7 score with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects a realistic threat model: low-privileged authenticated user (PR:L, e.g., a collaborator or import recipient), user interaction required to open the malicious typebot (UI:R), and a changed scope (S:C) reaching the builder's authenticated session from a tenant-supplied payload. EPSS and KEV data were not provided in the input, so widespread exploitation probability cannot be quantified; no public exploit identified at time of analysis. The CVSS-described risk is credible - the commit diff confirms the sink, the missing sanitizer, and the CSP weakness - making this a real priority for any multi-tenant or shared-workspace Typebot deployment rather than a paper-only high-CVSS issue. UI:R and PR:L meaningfully limit drive-by mass exploitation but do not protect against insider/collaborator abuse or social-engineered imports.

An attacker creates a malicious typebot JSON containing a Rating block whose customIcon.svg field embeds an SVG with an inline <script> or onload handler, then either publishes it for import or uses collaborator access to a shared workspace. When a victim builder user opens or previews the typebot, Solid's innerHTML directive injects the SVG into the builder.typebot.io DOM under the permissive CSP, executing the attacker's JavaScript with the victim's authenticated session and enabling session/cookie theft, API-token exfiltration, and privilege escalation across the victim's workspaces.