7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65098

CVE-2025-65098: Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65098

CVE-2025-65098:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@typebot.io/js	npm	< 0.9.15	0.9.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability consists of two main issues: client-side script execution and a backend authorization bypass. The provided patch, commit a68f0c91790af8f52f17557f4aa202e966e7e579, primarily addresses the client-side execution vector.

The analysis of the patch reveals that before the fix, the functions executeScript and executeSetVariable in the @typebot.io/js package were vulnerable. They both used the AsyncFunction constructor to execute arbitrary JavaScript provided in a typebot's definition. When a victim previewed a malicious typebot, this code would run in their browser with their active session, allowing the script to make authenticated requests.

The exploit PoC leverages this to call the insecure /api/trpc/credentials.getCredentials API endpoint, which improperly disclosed credentials without verifying ownership. The patch mitigates the client-side vulnerability by introducing a safety flag (isUnsafe) for imported bots. When this flag is set, the scripts are executed within a sandboxed Web Worker (runUserCodeInWorker) which has restricted network capabilities (e.g., fetch calls are made without credentials), thus preventing the malicious script from accessing the sensitive API endpoints. The identified functions, executeScript and executeSetVariable, are the entry points for the code execution and would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.