package

npm/@typebot.io/js

pkg:npm/%40typebot.io/js

HIGH7.4npm

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

Modified: 2/3/2026

HIGH8.7npm

Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

Modified: 9/10/2026

MEDIUM5.4npm

Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

Modified: 9/10/2026