This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2025-65098 | BDVDB-2026-311656 Detail

baptisteArnotypebot.io

Description#

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-284 Improper Access Control
  • CWE-311 Missing Encryption of Sensitive Data
  • CWE-522 Insufficiently Protected Credentials
  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-862 Missing Authorization

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.