Typebot vulnerabilities
We track 4 vulnerabilities in Typebot products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on January 22, 2026.
Latest Typebot vulnerabilities
- 7.4 High severity
typebot.io: Improper Neutralization of Input During Web Page Generation
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their bro
- 9.9 Critical severity
typebot.io: Server-Side Request Forgery
Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the s
- 7.5 High severity
typebot.io: Authorization Bypass Through User-Controlled Key
Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and
- 9.3 Critical severity
typebot.io: Improper Neutralization of Input During Web Page Generation
Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the `redirectPath` parameter from the URL. If a