baptistearno/typebot.io Security Advisories | GitStock

medium2026-05-26

Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

GHSA-hqmv-v56g-4m47 · CVE-2026-39964

high2026-05-26

Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

GHSA-6m7c-xfhp-p9fh · CVE-2026-28445

high2026-01-22

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

GHSA-4xc5-wfwc-jw47 · CVE-2025-65098