CVE-2026-39970 is a stored XSS vulnerability in TypeBot (baptisteArno) affecting versions prior to 3.16.0. The flaw arises from improper input neutralization during web page generation, specifically in the profile picture upload form at app.typebot.io. The application fails to sanitize or restrict SVG/XML-based uploads, allowing malicious SVG files containing JavaScript to be stored and rendered. When accessed, these files execute arbitrary JavaScript in the context of the victim's browser, enabling typical XSS impacts such as session hijacking and data theft. The vulnerability has a CVSS 4.0 score of 8.5 (high severity) and has been addressed in version 3.16.0.

Successful exploitation allows attackers to execute arbitrary JavaScript in users' browsers via stored XSS. This can lead to session or token theft, account takeover, and exfiltration of sensitive user data. The payload is persistently stored on the infrastructure and accessible through a public link, increasing the risk of widespread impact.

Upgrade TypeBot to version 3.16.0 or later, where this vulnerability has been fixed. Versions prior to 3.16.0 are vulnerable due to lack of proper SVG/XML sanitization in the profile picture upload form. No other mitigation is indicated by the vendor advisory.