Typebot CVE-2026-39970
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated upload (PR:L) with a victim who must view the stored SVG (UI:R); script runs in the app origin affecting other users so scope changes (S:C), with high confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The application fails to sanitize or restrict SVG/XML-based uploads and directly renders them when accessed through the domain. By uploading a crafted malicious SVG file containing embedded JavaScript, an attacker will execute arbitrary JavaScript code. This vulnerability directly enables stored XSS exploitation because the payload is persistently stored on your infrastructure (app.typebot.io) and accessible from a public-facing, permanent link. Stored XSS via malicious SVG uploads to app.typebot.io allows attackers to execute arbitrary JavaScript in victims' browsers, enabling session/token theft, account takeover, and exfiltration of sensitive user data. This issue has been fixed in version 3.16.0.
AnalysisAI
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a crafted SVG containing embedded JavaScript through the profile picture upload form; because the file is served unsanitized from the app.typebot.io domain via a permanent public link, the script executes in the browser of anyone who views it, enabling session/token theft, account takeover, and data exfiltration. Publicly available exploit code exists (SSVC: POC), but there is no confirmed active exploitation and EPSS is very low (0.05%, 15th percentile) with no CISA KEV listing.
Technical ContextAI
Typebot is an open-source chatbot builder (repository baptisteArno/typebot.io) whose hosted instance runs at app.typebot.io. The root cause is CWE-79 (improper neutralization of input during web page generation), specifically stored XSS. SVG is an XML-based image format that can legally embed <script> elements and event-handler attributes; when a web application accepts SVG uploads and later serves them with an image/svg+xml content type on its own origin (rather than sandboxing them or re-encoding to raster), the browser parses and executes the embedded script in that origin's context. Here the profile-picture upload path neither restricts SVG/XML uploads nor sanitizes their contents, and the stored file is rendered directly from the application domain, giving the payload same-origin execution against app.typebot.io.
RemediationAI
Upgrade to Typebot 3.16.0 or later (Vendor-released patch: v3.16.0), which addresses SVG upload handling; self-hosters should also invalidate existing sessions/tokens as a precaution given the account-takeover impact. Until upgrade, apply compensating controls on the upload path: reject SVG/XML content types on the profile-picture endpoint (trade-off: users lose SVG avatars, generally acceptable); or serve all user-uploaded files from a separate sandboxed origin/CDN with Content-Disposition: attachment and a restrictive Content-Security-Policy so SVGs cannot execute script in the app.typebot.io origin (trade-off: infrastructure change, may affect inline rendering); and/or re-encode uploaded images to a raster format (PNG/JPEG) to strip embedded scripts. See advisory GHSA-jj87-c343-26vp (https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-jj87-c343-26vp) and the v3.16.0 release notes (https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0).
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today