Typebot CVE-2026-39970

Requires an authenticated Typebot account (CVSS PR:L) with access to the profile picture upload form and the ability to upload a crafted SVG/XML file with embedded JavaScript to an instance running 3.15.2 or earlier. Exploitation additionally requires victim interaction (CVSS UI:P): a victim must load/view the stored malicious SVG served from the application domain (app.typebot.io) for the payload to fire. Limiting factors that reduce realistic risk: the attacker cannot be fully unauthenticated (an account is needed), the payload only triggers when another user renders the image, and instances on 3.16.0 or those that reject/sandbox SVG uploads are not exposed. Cross-user impact hinges on whether profile pictures are viewable by other users in the deployment.

The signals are consistent and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) indicates a network-reachable, low-complexity attack that requires the attacker to hold an account (PR:L) and requires a victim to view the malicious content (UI:P), yielding 8.5 (High). SSVC classifies exploitation as POC (not active), not automatable, with partial technical impact - consistent with the authentication-plus-victim-interaction requirement rather than mass unauthenticated scanning. EPSS is 0.05% and there is no KEV listing, so despite the high CVSS this is not evidence of widespread exploitation; the score is driven by same-origin script execution impact (account takeover), not ease of mass exploitation. Net: patch promptly for multi-tenant or self-hosted deployments because account takeover is serious, but this is not an internet-wormable emergency. One caveat to verify with the vendor: whether an uploaded avatar is viewable by other users determines whether this is cross-user stored XSS or self-XSS only - the advisory's 'public permanent link' framing implies cross-user reach but is not code-verified here.

An attacker uses a Typebot account to upload a crafted SVG containing embedded JavaScript (e.g. an onload handler that reads document.cookie or session tokens) as their profile picture. When a victim such as an admin or workspace member views the attacker's avatar, the SVG is served from app.typebot.io and its script runs in the victim's session, exfiltrating tokens to an attacker-controlled server and enabling account takeover. POC-level exploitation is documented per SSVC.