Client-Side Script Execution Vulnerability in Typebot by Baptiste Arno
CVE-2025-65098

7.4HIGH

Key Information:

Vendor

Baptistearno

Status
Typebot.io
Vendor
CVE Published:
22 January 2026

What is CVE-2025-65098?

Typebot, an open-source chatbot builder developed by Baptiste Arno, is affected by a vulnerability that enables client-side script execution. This flaw allows malicious actors to exfiltrate sensitive credentials such as OpenAI keys, Google Sheets tokens, and SMTP passwords when a victim previews a compromised Typebot. Specifically, the vulnerability lies in the inability of the /api/trpc/credentials.getCredentials endpoint to authenticate the ownership of credentials, returning sensitive information in plaintext. Users are advised to upgrade to version 3.13.2 to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

typebot.io < 3.13.2

References

https://github.com/baptisteArno/typebot.io/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.