Is CVE-2025-65098 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65098 being exploited in the wild.

How severe is CVE-2025-65098?

Low severity, with a CVSS score of 3.1, published 22 January 2026.

Which products and versions are affected?

@typebot.io/js (npm) SEMVER:introduced=0,fixed=0.9.15; Typebot <=3.13.1.

Is there a fix for CVE-2025-65098?

Yes. @typebot.io/js (npm): upgrade to 0.9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-65098 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-65098?

Check whether you run @typebot.io/js (npm) or Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65098: Typebot credential theft via client-side script execution

Q: Is there a fix for CVE-2025-65098?

Yes. @typebot.io/js (npm): upgrade to 0.9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-65098 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2025-65098?

Check whether you run @typebot.io/js (npm) or Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65098 · Severity: low · CVSS 3.1 · Published 2026-01-22

Typebot, a popular chatbot builder platform, contains a vulnerability that allows attackers to steal all stored API credentials from users. When a victim previews a malicious chatbot, arbitrary JavaScript code executes in their browser with their authenticated session, enabling theft of OpenAI keys, Google Sheets tokens, SMTP passwords, and other sensitive credentials stored in the platform. Combined with an API authorization bypass, attackers can retrieve plaintext credentials belonging to any user without ownership verification.

Technologies: @typebot.io/js (npm), Typebot. Vendors: npm, Typebot.

Quick answers

Is CVE-2025-65098 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65098 being exploited in the wild.
How severe is CVE-2025-65098?: Low severity, with a CVSS score of 3.1, published 22 January 2026.
Which products and versions are affected?: @typebot.io/js (npm) SEMVER:introduced=0,fixed=0.9.15; Typebot <=3.13.1.
Is there a fix for CVE-2025-65098?: Yes. @typebot.io/js (npm): upgrade to 0.9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65098 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-65098?: Check whether you run @typebot.io/js (npm) or Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@typebot.io/js (npm): upgrade to 0.9.15 or later
```
npm install @typebot.io/js@0.9.15
```

Technical details

The vulnerability comprises two components. First, the Script block with "Execute on client" enabled runs arbitrary JavaScript in the victim's browser within their authenticated session context, allowing API calls on their behalf. Second, the `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys and tokens after checking only authentication status, not credential ownership—any authenticated user can retrieve any credential by iterating credential IDs. The root causes are inadequate input sanitization in client-side script execution, missing access control checks in the credentials endpoint, and lack of user warnings. Exploitation requires minimal privileges (free tier sufficient) and only user interaction to preview a malicious bot. Attack vectors are network-based, and the impact is high: full compromise of all stored credentials including third-party API keys and authentication tokens. A patch was released in version 3.13.2; vulnerable versions are 3.13.1 and earlier.

Affected products

Typebot Typebot <=3.13.1

Identifiers

CVE-2025-65098
GHSA-4xc5-wfwc-jw47

Timeline

2026-01-22: disclosed
2026-01-22: patched: Fixed in version 3.13.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.