CVE-2026-39964

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker's JavaScript runs in the host page's origin and can exfiltrate cookies and session tokens. This can result in any authenticated Typebot user (including those on the free tier) being able to create a bot with this payload. Shared bots are publicly accessible — no victim authentication is required. This issue has been resolved in version 3.16.0.

• CWE-79

• https://github.com/baptisteArno/typebot.io/commit/2c3fc7267a5e1529ba4b1a2ab4f1edb3e3b8990b
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-hqmv-v56g-4m47
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-hqmv-v56g-4m47

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39959Tmds.DBus provides .NET libraries for working with D-Bus fro…7.1
• CVE-2026-3996The WP Games Embed plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-39960Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.4
• CVE-2026-39961Aiven Operator allows you to provision and manage Aiven Serv…4.9
• CVE-2026-39962MISP is an open source threat intelligence and sharing platf…9.6
• CVE-2026-39963Serendipity is a PHP-powered weblog engine. In versions 2.6-…6.9
• CVE-2026-39965TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…7.7
• CVE-2026-39966TypeBot is a chatbot builder tool. In versions 3.15.2, the g…6.5
• CVE-2026-39967TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…3.1
• CVE-2026-39968TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…7.1
• CVE-2026-39969TypeBot is a chatbot builder tool. In versions 3.16.0 and pr…6.5
• CVE-2026-3997The Text Toggle plugin for WordPress is vulnerable to Stored…6.4