AI Threat Alert
CVE-2025-65098
HIGHTypebot versions prior to 3.13.2 expose a critical credential theft vector: any user tricked into previewing a malicious chatbot will have their OpenAI API keys, OAuth tokens, and SMTP credentials silently exfiltrated via XSS. Patch to 3.13.2 immediately and rotate all API credentials stored in Typebot instances — assume keys are compromised if any user previewed an untrusted bot. Organizations relying on Typebot-integrated LLM pipelines face unauthorized API usage, billing fraud, and downstream data exposure across connected AI services.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| typebot | — | — | No patch |
Do you use typebot? You're affected.
Severity & Risk
Recommended Action
- 1) Upgrade Typebot to 3.13.2 immediately — patch is available, no workaround is viable. 2) Rotate ALL credentials stored in Typebot: OpenAI API keys, Google OAuth tokens, SMTP passwords — treat as compromised if any user previewed an untrusted bot. 3) Audit OpenAI API usage logs for anomalous calls in the past 30 days. 4) Check Google Workspace audit logs for unexpected Sheets access. 5) Add Content-Security-Policy headers blocking inline script execution as defense-in-depth. 6) Enforce credential ownership verification on all credential-returning API endpoints (BOLA fix). 7) Migrate to secrets managers (AWS Secrets Manager, HashiCorp Vault) instead of storing plaintext API keys in application databases. 8) Alert on mass credential read events from single sessions in API gateway logs.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.
Exploitation Scenario
Attacker creates a Typebot instance embedding malicious JavaScript in a custom HTML/code block. Attacker shares a preview link via Slack, email, or GitHub targeting Typebot administrators or developers. Victim clicks 'Run' to preview the bot — no account linkage or elevated permissions required. JavaScript executes in the victim's browser, calls `/api/trpc/credentials.getCredentials` which returns all stored credentials in plaintext without verifying ownership. OpenAI key, Google OAuth token, and SMTP password are immediately POSTed to an attacker-controlled webhook. Attacker begins using stolen OpenAI key within minutes — victim's quota drains, attacker gains access to LLM endpoints and any data flowing through the victim's AI automation pipelines.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N