CVE-2026-11436: Reflected XSS in Mage AI Sign-In Flow (v0.9.79 and Earlier)

Technical summary

The vulnerability exists in the useMutation hook implementation within mage_ai/frontend/components/Sessions/SignForm/index.tsx. The query.redirect_url parameter is not properly sanitized before being used, allowing injection of arbitrary JavaScript. The attack vector is network-based with low complexity; the vulnerability chain involves both Improper Neutralization of Input During Web Page Generation (CWE-79) and Improper Control of Generation of Code (CWE-94). While the CVSS score of 4.3 reflects the requirement for user interaction and lack of confidentiality impact, the public availability of exploit details elevates practical risk.

Business impact

Organizations running Mage AI for data orchestration or workflow management face reputational and operational risk. A successful attack could compromise user sessions, steal authentication tokens, deface the application interface, or redirect users to phishing pages. If Mage AI is used in customer-facing or multi-tenant environments, the blast radius extends to end-users. The lack of vendor responsiveness suggests patches may be delayed or unavailable through official channels.

Affected systems

Mage AI versions 0.9.79 and earlier are confirmed vulnerable. The sign-in flow component affects all deployments where users authenticate. Web-based access to Mage AI—whether on-premises or cloud-hosted—is exploitable. Organizations should verify their installed version immediately; if running version 0.9.79 or below, assume exposure.

Exploitability

Exploitation is straightforward: an attacker constructs a URL embedding malicious JavaScript in the redirect_url query parameter and socializes it via email, chat, or other channels. When a user clicks the link and arrives at the Mage AI sign-in page, the payload executes in their browser. No special tools, authentication, or server-side tricks are required. The fact that exploits are publicly available means attackers have working proof-of-concepts and barrier to weaponization is negligible. User education remains a critical control, but cannot be the sole mitigation.

Remediation

Immediately update Mage AI to the latest available version beyond 0.9.79; verify the patch changelog confirms XSS remediation in the sign-in flow. If an update is not yet available from the vendor due to lack of response, implement a compensating control: deploy a Web Application Firewall (WAF) rule to detect and block requests with suspicious redirect_url parameters (e.g., those containing 'javascript:', 'onerror=', or other common XSS payloads). Additionally, enable Content Security Policy (CSP) headers to restrict inline script execution. These mitigations reduce risk but are not substitutes for patching.

Patch guidance

Check the Mage AI GitHub releases page and official documentation for versions newer than 0.9.79. Because the vendor reportedly did not respond to early disclosure, there is no coordinated release date provided. Once a patch is available, test it in a non-production environment to ensure compatibility with your configuration and dependent workflows. If no official patch is forthcoming within a reasonable timeframe (e.g., 30 days), escalate the matter to Mage AI maintainers via GitHub issues and consider alternative orchestration tools if security posture is critical to your organization.

Detection guidance

Search web server and application logs for GET or POST requests to the sign-in endpoint with redirect_url parameters containing encoded or unencoded JavaScript keywords (e.g., 'script', 'onerror', 'onload', 'eval'). Monitor for unusual redirect patterns that point to external or suspicious domains. If Mage AI logs user interactions, check for failed authentication attempts correlated with redirect_url manipulation. Deploy a WAF or SIEM rule to flag these patterns in real time. Endpoint detection can monitor for unusual JavaScript execution context originating from the Mage AI domain in user browsers.

Why prioritize this

Although the CVSS score is moderate (4.3), the combination of public exploit availability, low barrier to weaponization, and vendor unresponsiveness elevates practical urgency. The XSS can compromise user credentials, sessions, and trust. Organizations should prioritize patching within 1–2 weeks. If a patch is unavailable, implement WAF/CSP controls immediately to reduce surface exposure. This is not a critical zero-day requiring emergency response, but it is actionable and should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: Network Attack Vector (AV:N), Low Attack Complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The user interaction requirement caps the score; the attacker cannot unilaterally exploit this without victim action. However, integrity impact (ability to inject and execute scripts) is the core threat. The lack of a confidentiality or availability impact in the base vector understates the practical risk if the XSS is chained with session hijacking or credential theft.

Frequently asked questions