TypeBot, a chatbot builder tool, had an XSS vulnerability (CWE-79) in versions before 3.16.0 where the viewer component rendered anchor tags with javascript: URIs from rich text bubble content without filtering. This allowed bot authors to embed malicious JavaScript that executes in the context of the host page when a visitor clicks the link. Because shared bots are publicly accessible without victim authentication, this vulnerability could be exploited by any authenticated user to target visitors of embedded bots. The vulnerability has been resolved in TypeBot version 3.16.0.

Successful exploitation allows execution of arbitrary JavaScript in the context of the host page embedding the TypeBot viewer. This can lead to theft of cookies and session tokens, compromising user sessions and potentially enabling further attacks. The vulnerability affects all authenticated TypeBot users who can create bots, including free tier users, and targets visitors of embedded bots without requiring victim authentication. The CVSS score is 5.4 (medium severity), reflecting limited scope and required user interaction.

Upgrade TypeBot to version 3.16.0 or later, where this vulnerability has been fixed. Since the vulnerability is resolved in this version, no additional mitigation is required. Users should ensure they do not use affected versions in production environments.