TypeBot is a chatbot builder tool

CVE-2026-39970 is a stored XSS flaw in Typebot's profile-picture upload flow: affected builds <= 3.15.2 let an authenticated user upload a malicious SVG as an avatar, and the file is then publicly retrievable. The bug is persistence, not code execution on the server; the attacker plants active browser content inside an uploaded SVG and waits for someone to open the hosted file.

The original advisory language calls this *critical*, but that overshoots the real deployment story. In practice the chain needs authenticated upload rights, a victim who opens the raw SVG URL, and useful security context on the file-serving origin; on Typebot Cloud the sample payload is hosted from s3.typebot.io, which materially limits blast radius versus a same-origin app XSS. That combination keeps this out of the emergency lane even though the underlying bug is valid.

Why this verdict

• Requires authenticated remote access: the attacker must already hold a valid Typebot account that can hit the avatar upload flow. That is immediate downward pressure because this is post-account-acquisition, not perimeter compromise.
• Needs victim interaction: the payload is not a worm sitting in the main UI; a victim must open the raw SVG or equivalent active rendering context. Email security, browser isolation, and ordinary user skepticism stop a meaningful slice of attempts.
• Default blast radius is usually origin-limited: the advisory's own sample shows hosting from s3.typebot.io, which means script execution is likely on the storage origin rather than app.typebot.io. Unless self-hosting choices collapse that boundary, the attacker gets less than a normal same-origin stored XSS.

Why not higher?

It is not higher because the chain stacks three big frictions: authenticated access, victim click/open, and likely origin separation. Those are compounding brakes, not minor caveats. A same-origin admin-panel stored XSS with unauthenticated planting or automatic trigger behavior would be a different conversation.

Why not lower?

It is not lower because the bug is persistent, trivially reproducible, and weaponizable on a trusted vendor domain. If your deployment serves uploads from the same origin, uses broad cookie domains, or exposes builder access to many semi-trusted users, impact can jump from annoyance to real credential or session abuse.

1. Block SVG avatar uploads — Enforce MIME and extension restrictions for profile/avatar uploads so only non-active image types like PNG/JPEG are accepted. If you cannot patch immediately, deploy this as your first compensating control; for a MEDIUM verdict there is no mitigation SLA, but it is still the cleanest temporary risk reduction.
2. Force downloads for uploaded SVG — Serve any existing .svg objects with Content-Disposition: attachment and a non-executable content type where your stack allows it. This reduces script-capable rendering while you move to 3.16.0 within the remediation window.
3. Separate auth and file origins — Keep uploaded content on an origin that does not share cookies, local storage, or parent-domain auth scope with the builder app. This matters most on self-hosted deployments and should be validated before your 365-day remediation deadline.
4. Audit builder-account sprawl — Review who can create or edit workspaces and who can upload profile assets. Because exploitation starts with a valid account, pruning stale or over-privileged builder users meaningfully lowers exposure while you schedule the patch.
5. Hunt for existing malicious SVGs — Search your object store or upload directory for .svg avatars and unusual XML/script content. Removing already-planted payloads limits persistence even if some nodes remain unpatched during the remediation window.

Run this on the Typebot host or inside the Typebot container where the application files are present. Invoke it as sudo bash check_cve_2026_39970.sh /opt/typebot or docker exec -it <typebot-container> bash /tmp/check_cve_2026_39970.sh /app; it needs read access to package.json only.

#!/usr/bin/env bash
# check_cve_2026_39970.sh
# Determine whether a local Typebot installation is affected by CVE-2026-39970.
# Usage: bash check_cve_2026_39970.sh /path/to/typebot
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

set -euo pipefail

TARGET_DIR="${1:-}"
if [[ -z "$TARGET_DIR" ]]; then
  echo "UNKNOWN: missing path argument"
  exit 2
fi

PKG="$TARGET_DIR/package.json"
if [[ ! -f "$PKG" ]]; then
  echo "UNKNOWN: package.json not found at $PKG"
  exit 2
fi

if ! command -v python3 >/dev/null 2>&1; then
  echo "UNKNOWN: python3 is required for version comparison"
  exit 2
fi

VERSION=$(python3 - <<'PY' "$PKG"
import json, sys
p = sys.argv[1]
try:
    with open(p, 'r', encoding='utf-8') as f:
        data = json.load(f)
    v = data.get('version')
    if not v:
        print('')
    else:
        print(str(v).strip())
except Exception:
    print('')
PY
)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not read version from $PKG"
  exit 2
fi

python3 - <<'PY' "$VERSION"
import re, sys
from itertools import zip_longest

version = sys.argv[1].strip()

# Normalize strings like v3.15.2, 3.15.2-beta, etc.
def normalize(v):
    v = v.lstrip('vV')
    main = re.split(r'[-+]', v, 1)[0]
    parts = [int(x) for x in main.split('.') if x.isdigit()]
    return parts

def cmp(a, b):
    for x, y in zip_longest(a, b, fillvalue=0):
        if x < y:
            return -1
        if x > y:
            return 1
    return 0

cur = normalize(version)
if not cur:
    print('UNKNOWN: unparseable version')
    sys.exit(2)

vuln_max = normalize('3.15.2')
patched_min = normalize('3.16.0')

if cmp(cur, vuln_max) <= 0:
    print(f'VULNERABLE: Typebot {version} <= 3.15.2')
    sys.exit(1)
elif cmp(cur, patched_min) >= 0:
    print(f'PATCHED: Typebot {version} >= 3.16.0')
    sys.exit(0)
else:
    print(f'UNKNOWN: Typebot {version} falls in an unexpected comparison state')
    sys.exit(2)
PY

Sources

1. GitHub Security Advisory GHSA-jj87-c343-26vp
2. Typebot release v3.16.0
3. NVD CVE-2026-39970
4. Typebot repository README
5. Typebot docs overview
6. Typebot settings docs
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS data documentation