CVE-2026-39964
Medium · 5.4Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
CVSS
5.4
EPSS
0.3%
Published
May 26, 2026
CISA due date
—
The record
The Typebot viewer (`packages/embeds/js`) renders anchor tags from rich text bubble content without filtering the `javascript:` URI scheme. A bot author can set a link URL to `javascript:PAYLOAD`, which executes in the visitor's browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker's JavaScript runs in the host page's origin and can exfiltrate cookies and session tokens.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @typebot.io/js | 0 | 0.10.1 |
Related vulnerabilities
- GHSA-hqmv-v56g-4m47 Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author… Same vulnerability
- GHSA-6m7c-xfhp-p9fh Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in… Also affects @typebot.io/js
- CVE-2026-28445 Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in… Also affects @typebot.io/js
- GHSA-4xc5-wfwc-jw47 Typebot affected by Credential Theft via Client-Side Script Execution and API… Also affects @typebot.io/js
- CVE-2025-65098 Typebot affected by Credential Theft via Client-Side Script Execution and API… Also affects @typebot.io/js
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79