GHSA-4xc5-wfwc-jw47
High · 7.4CVSS
7.4
EPSS
—
Published
Jan 22, 2026
CISA due date
—
The record
Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @typebot.io/js | 0 | 0.9.15 |
Related vulnerabilities
- CVE-2025-65098 Typebot affected by Credential Theft via Client-Side Script Execution and API… Same vulnerability
- GHSA-hqmv-v56g-4m47 Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author… Also affects @typebot.io/js
- GHSA-6m7c-xfhp-p9fh Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in… Also affects @typebot.io/js
- CVE-2026-28445 Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in… Also affects @typebot.io/js
- CVE-2026-39964 Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author… Also affects @typebot.io/js
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79