Cross-Site Scripting Vulnerability in Mage AI Sign-in Flow Component
CVE-2026-11436

5.3MEDIUM

Key Information:

Vendor: Mage AI
Status: Mage Ai
Vendor: CVE Published:; 6 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11436?

A cross-site scripting vulnerability has been identified in the Sign-in Flow component of Mage AI, affecting versions up to 0.9.79. This issue arises from the manipulation of the argument 'query.redirect_url' within the useMutation function located in the index.tsx file. Successful exploitation allows attackers to execute arbitrary scripts in the context of the user’s session, potentially compromising sensitive information. As the exploit has been made public, prompt action is advised for users of the affected versions.

Affected Version(s)

Mage AI 0.9.0

Mage AI 0.9.1

Mage AI 0.9.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-11436 - Proof of Concept