CVE-2026-39970: TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form
TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The application fails to sanitize or restrict SVG/XML-based uploads and directly renders them when accessed through the domain. By uploading a crafted malicious SVG file containing embedded JavaScript, an attacker will execute arbitrary JavaScript code. This vulnerability directly enables stored XSS exploitation because the payload is persistently stored on your infrastructure (app.typebot.io) and accessible from a public-facing, permanent link. Stored XSS via malicious SVG uploads to app.typebot.io allows attackers to execute arbitrary JavaScript in victims' browsers, enabling session/token theft, account takeover, and exfiltration of sensitive user data. This issue has been fixed in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TypeBot (app.typebot.io)to a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39970?
CVE-2026-39970 has a risk score of 62, indicating a significant vulnerability level.
How do I fix CVE-2026-39970?
To fix CVE-2026-39970, upgrade to TypeBot version 3.16.0 or later, where the XSS vulnerability has been addressed.
What does CVE-2026-39970 affect?
CVE-2026-39970 affects TypeBot versions 3.15.2 and earlier, specifically through the profile picture upload form.
What type of vulnerability is CVE-2026-39970?
CVE-2026-39970 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
How can the stored XSS in CVE-2026-39970 be exploited?
The stored XSS in CVE-2026-39970 can be exploited by uploading a malicious SVG file that executes when rendered.