GHSA-hqmv-v56g-4m47: Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

Summary

The Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author who sets a link URL to javascript:PAYLOAD gets that script run in a visitor's browser when the link is clicked, and because the viewer is usually embedded in third-party sites, the script runs in the host page's origin and can read cookies and session tokens. The flaw is in PlateBlock.tsx line 32, with the same issue in ImageBubble.tsx line 102 for image link wrapping.

Mitigation

Proposed fix: filter javascript: URIs before rendering anchor tags, for example by replacing them with '#' using a safeUrl helper, or use a URL allowlist permitting only https:, http:, mailto: and tel:.

Related items

• HighCVE-2026-109331: Network-AI security control bypass in ClaudeHookBridge PreToolUse hookSimilar attack · NVD/CVE Database
• MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSimilar attack · NVD/CVE Database
• MediumCVE-2026-109292: Open WebUI information disclosure exposing session cookies on OAuth connectionsSimilar attack · NVD/CVE Database
• HighCVE-2026-108953: mac-shell-mcp OS command injection through execute_command argumentsSimilar attack · NVD/CVE Database
• HighCVE-2026-108836: Ollama server-side request forgery in Pull APISimilar attack · NVD/CVE Database