Cross-Site Scripting Vulnerability in Typebot Chatbot Builder Tool

CVE-2026-28445

What is CVE-2026-28445?

The Typebot chatbot builder tool is susceptible to a cross-site scripting vulnerability due to improper rendering of user-controlled icons in the RatingButton component. In versions up to 3.15.2, this flaw allows malicious actors to inject arbitrary HTML or JavaScript. This is made possible because the platform directly uses the customIcon.svg input without sanitization, despite having DOMPurify as a dependency. As a result, crafted bots can execute harmful scripts within the application's authenticated context, bypassing security measures like the Web Worker sandbox and potentially leading to session hijacking and privilege escalation. This vulnerability has been addressed in version 3.16.0.

References