Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The application fails to sanitize or restrict SVG/XML-based uploads and directly renders them when accessed through the domain. By uploading a crafted malicious SVG file containing embedded JavaScript, an attacker will execute arbitrary JavaScript code. This vulnerability directly enables stored XSS exploitation because the payload is persistently stored on your infrastructure (app.typebot.io) and accessible from a public-facing, permanent link. Stored XSS via malicious SVG uploads to app.typebot.io allows attackers to execute arbitrary JavaScript in victims' browsers, enabling session/token theft, account takeover, and exfiltration of sensitive user data. This issue has been fixed in version 3.16.0.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-23 | 1 | Active Exploitation1 |
| 2026-06-08 | 1 | Patch1 |
| 2026-06-09 | 1 | General1 |
| 2026-06-12 | 1 | Disclosure1 |
CVE-2026-39970 TypeBot バージョン3.15.2以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-39970-typebot-3152/ #IT #Security #cybersecurity
Post summary
The text points to a Japanese article that explains a TypeBot vulnerability affecting versions before 3.15.2, discussing impact and mitigation, but offers no PoC, exploit details, patch information, or evidence of active exploitation.
CVE-2026-39970 TypeBot バージョン3.15.2以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-39970-typebot-3152/ #IT #Security #cybersecurity
Post summary
An article outline describes a vulnerability affecting TypeBot versions ≤3.15.2, but provides no technical details, exploit code, patch, or evidence of active attacks.
CVE-2026-39970 TypeBot バージョン3.15.2以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/06/cve-2026-39970-typebot-3152/ #IT #Security #cybersecurity
Post summary
An article explaining the TypeBot vulnerability (CVE‑2026‑39970) provides technical details and discusses patches and mitigations, but does not mention PoC, exploit code, or active exploitation.
It is possible to see elevated activities targeting baptisteArno http://typebot.io (CVE-2026-39970) https://vuldb.com/vuln/365262/cti
Post summary
The post indicates that there may be active attacks against CVE-2026-39970, but it lacks concrete proof of exploitation, technical details, or patch information.