CVE-2026-11436

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mage_ai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirect_url results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	Mage AI	0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; 0.9.6; 0.9.7; 0.9.8; 0.9.9; 0.9.10; 0.9.11; 0.9.12; 0.9.13; 0.9.14; 0.9.15; 0.9.16; 0.9.17; 0.9.18; 0.9.19

References

Timeline

Published: Jun 6, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1143615.6A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Id CVE-2026-1143626.3A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets T CVE-2026-1143649.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an CVE-2026-1143662.3An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.CVE-2026-1143692.7Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module CVE-2026-114377.3A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the co CVE-2026-1143703.7A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files fro CVE-2026-1143719.9Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex CVE-2026-1143725.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-1143735.5Photoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-service. An attacker could exp CVE-2026-1143744.3A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metada CVE-2026-1143756.3A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/