CVE-2025-65098

CVE-2025-65098 affects Typebot (open-source chatbot builder) in versions before 3.13.2. A client-side script executed when a victim previews a malicious typebot can exfiltrate stored credentials (e.g., OpenAI keys, Google Sheets tokens, SMTP passwords) via the API endpoint /api/trpc/credentials.g...

CVE-2025-65098 Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI key...

EUVD-2026-4135

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI key...

CVE-2025-65098 Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI key...

PT-2026-3944

Name of the Vulnerable Software and Affected Versions Typebot versions prior to 3.13.2 Description Typebot, an open-source chatbot builder, has a flaw where client-side script execution can lead to the theft of stored credentials from any user. When a victim previews a malicious typebot by clicki...

Typebot security vulnerabilities

Typebot is an open-source chat bot builder developed by Baptiste Arnaud. Versions of Typebot prior to 3.13.2 contained a security vulnerability. This vulnerability stemmed from client-side script execution, where credential endpoints returned plaintext API keys, which could lead to the theft of...

EUVD-2016-10634

Malware in sbrugna...

EUVD-2017-0006

Malware in sbrugna...

EUVD-2017-1507

Malware in sbrugna...

EUVD-2019-16389

Malware in sbrugna...

EUVD-2018-0750

Malware in sbrugna...

EUVD-2019-7004

Malware in sbrugna...

EUVD-2022-47691

Malicious code in bioql PyPI...

EUVD-2024-28049

Malicious code in bioql PyPI...

EUVD-2024-20706

Malicious code in bioql PyPI...

EUVD-2024-20705

Malicious code in bioql PyPI...

EUVD-2023-52313

Malicious code in bioql PyPI...

EUVD-2024-28083

Malicious code in bioql PyPI...

EUVD-2025-22332

Malicious code in bioql PyPI...

EUVD-2025-22327

Malicious code in bioql PyPI...