GHSA-6m7c-xfhp-p9fh: Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

Typebot has a stored XSS (cross-site scripting, where attackers inject malicious code into a web page) vulnerability in its rating block's custom icon feature. The vulnerability allows attackers to execute arbitrary HTML and JavaScript in the builder's preview by crafting a malicious typebot, potentially leading to session hijacking and unauthorized access to the builder application. This bypasses the sandbox protection that normally prevents untrusted code from running in the builder.