CVE-2026-39964: Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

The Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor’s browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker’s JavaScript runs in the host page’s origin and can exfiltrate cookies and session tokens.