EUVD-2026-31480
GHSA-hqmv-v56g-4m47
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on @typebot.io/js (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.10.1.
DescriptionCVE.org
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker's JavaScript runs in the host page's origin and can exfiltrate cookies and session tokens. This can result in any authenticated Typebot user (including those on the free tier) being able to create a bot with this payload. Shared bots are publicly accessible - no victim authentication is required. This issue has been resolved in version 3.16.0.
AnalysisAI
Stored XSS in Typebot's JavaScript viewer embed (packages/embeds/js) allows any authenticated bot author - including free-tier users - to inject arbitrary JavaScript into a visitor's browser by setting a rich text bubble link URL to a javascript: URI. When a visitor clicks the malicious link within an embedded bot, the payload executes in the host page's origin (S:C scope change), enabling exfiltration of cookies and session tokens from the embedding third-party site. No public exploit code or active exploitation is confirmed at time of analysis; a vendor-released patch is available in v3.16.0.
Technical ContextAI
The vulnerable component is the Typebot JavaScript embed viewer (packages/embeds/js, bumped from v0.10.0 to v0.10.1 in the fix). Three rendering paths were affected: Bot.tsx (link() href for generic links), PlateBlock.tsx (rich text Plate editor anchor elements), and ImageBubble.tsx (image click links). All three assigned user-supplied URL strings directly to href attributes without validating the URI scheme, enabling javascript: pseudo-protocol injection - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) instance. The CVSS S:C (Changed Scope) vector element reflects that the injected script executes not in the Typebot viewer's origin but in the embedding host page's origin. The fix introduces a new sanitizeUrl utility (packages/embeds/js/src/lib/sanitizeUrl.ts) that allowlists https:, http:, mailto:, and tel: protocols, returning '#' for anything else including javascript:, data:, and vbscript: URIs.
RemediationAI
Upgrade typebot.io to version 3.16.0, confirmed via the GitHub release tag at https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0. The fix is implemented in commit 2c3fc7267a5e1529ba4b1a2ab4f1edb3e3b8990b, which adds a sanitizeUrl utility that allowlists https:, http:, mailto:, and tel: URI schemes across all three affected rendering paths. For self-hosted deployments that cannot immediately upgrade, a compensating control is to restrict bot creation to trusted internal users only (remove public/free-tier registration), which eliminates the PR:L attack path; note this does not protect against malicious insiders. Blocking iframe embedding of the Typebot viewer entirely (via Content-Security-Policy frame-ancestors restrictions on the host site) would prevent the S:C host-origin execution impact but would also break legitimate embed functionality. Review any currently published bots for suspicious javascript: URIs in link fields before deploying the patch.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today