Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg field directly via Solid's innerHTML directive without any sanitization, even though DOMPurify is already a dependency and is used elsewhere in the codebase (e.g., StreamingBubble.tsx). Because rating blocks are not flagged as isUnsafe by the import sanitizer and the builder preview renders bots inline on the builder's own origin (builder.typebot.io) under a CSP permitting 'unsafe-inline', a malicious imported or collaborator-crafted typebot can execute arbitrary HTML/JS in the builder's authenticated context, bypassing the Web Worker sandbox that protects Script blocks during preview. This allows session hijacking and privilege escalation within the builder application. This issue has been fixed in version 3.16.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| baptisteArno | typebot.io | before 3.16.0 | 3.16.0 | Patch available | CNA |
| — | @typebot.io/js (npm) | before 0.10.1 | 0.10.1 | Patch available | GHSA-6m7c-xfhp-p9fh |
- typebot.io VendorbaptisteArno Affected before 3.16.0 Fixed in 3.16.0 Patch available CNA
- @typebot.io/js (npm) Vendor— Affected before 0.10.1 Fixed in 0.10.1 Patch available GHSA-6m7c-xfhp-p9fh
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typebot:typebot:*:*:*:*:*:*:*:* | — | — | baptisteArno |
- cpe:2.3:a:typebot:typebot:*:*:*:*:*:*:*:* Versions — — ·baptisteArno
Remediation
- Fix · CNA typebot.io (baptisteArno) Fixed in 3.16.0
- Fix · GHSA-6m7c-xfhp-p9fh @typebot.io/js (npm) Fixed in 0.10.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-28445
- 2026-10-03 Alias added: GHSA-6m7c-xfhp-p9fh
References
Other 5
- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-6m7c-xfhp-p9fh
- https://github.com/baptisteArno/typebot.io/commit/474ecbf46bc47a75265bada2599f12b2179de375
- https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0
- https://github.com/baptisteArno/typebot.io
- https://github.com/baptisteArno/typebot.io/blob/v3.16.0/packages/embeds/js/package.json
More baptisteArno vulnerabilities
- TI-2026-26091 TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls CVSS 3.1CRITICAL 10.0
- TI-2026-36038 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName CVSS 3.1CRITICAL 9.3
- TI-2026-44929 TypeBot: Arbitrary server file read via Send Email block attachment path CVSS 4.0HIGH 8.7
- TI-2026-36035 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding CVSS 3.1CRITICAL 9.9
- TI-2026-35208 TypeBot vulnerable to CSV injection in result export CVSS 3.1CRITICAL 9.6
- TI-2025-40055 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-28445 · CVE Program
- CVE-2026-28445 · NVD
- FIRST EPSS
- GHSA-6m7c-xfhp-p9fh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences