PatchSiren cyber security CVE debrief
CVE-2026-39970 baptisteArno CVE debrief
A critical stored XSS vulnerability exists in TypeBot versions 3.15.2 and prior. The app.typebot.io profile picture upload form fails to sanitize SVG/XML-based uploads, allowing embedded JavaScript execution. Attackers can upload malicious SVG files to persistently store and execute arbitrary JavaScript code, enabling session/token theft, account takeover, and sensitive user data exfiltration. This issue is fixed in version 3.16.0.
- Vendor
- baptisteArno
- Product
- typebot.io
- CVSS
- HIGH 8.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-07-23
Who should care
Developers and administrators using TypeBot versions 3.15.2 and prior should prioritize upgrading to version 3.16.0 to mitigate this vulnerability. Users of TypeBot's app.typebot.io platform are also advised to be cautious with profile picture uploads and monitor for suspicious activity.
Technical summary
The vulnerability arises from TypeBot's failure to properly sanitize or restrict SVG/XML-based uploads in the profile picture form. Attackers can craft malicious SVG files containing JavaScript, which is then persistently stored and executed when accessed through a public-facing link. This enables stored XSS exploitation, allowing attackers to execute arbitrary JavaScript in victims' browsers. The issue affects TypeBot versions 3.15.2 and prior, with the fix implemented in version 3.16.0. Users should verify their deployments and upgrade to mitigate this vulnerability.
Defensive priority
High priority should be given to upgrading TypeBot to version 3.16.0. In the meantime, restrict profile picture uploads to trusted sources, and monitor app.typebot.io for suspicious activity. Implement additional security measures such as input validation and output encoding to prevent similar vulnerabilities.
Recommended defensive actions
- Upgrade TypeBot to version 3.16.0 or later
- Restrict profile picture uploads to trusted sources
- Monitor app.typebot.io for suspicious activity
- Implement input validation and output encoding
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-05-22T19:17:03.633Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. References include the official CVE record, NVD detail, and source references from [email protected].
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T19:17:03.633Z and has not been modified since then. The NVD entry is currently Deferred.