PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9566 teableio CVE debrief

A cross-site scripting (XSS) vulnerability exists in Teable's login redirect functionality. The issue stems from insufficient validation of the `redirect` parameter in the login page component, allowing manipulation that could lead to XSS. The vulnerability is remotely exploitable and has publicly available exploit information. The vendor has confirmed remediation through input validation using `isValidRedirectPath()` to block dangerous schemes including `javascript:`, `data:`, and cross-origin redirects.

Vendor
teableio
Product
teable
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Organizations running Teable instances prior to release.2026-04-21T08-57-20Z.1513, particularly those with externally accessible authentication endpoints. Security teams monitoring for open-source application vulnerabilities and XSS attack vectors in authentication flows.

Technical summary

The vulnerability resides in `apps/nextjs-app/src/features/auth/pages/LoginPage.tsx` in the sign-up component's handling of the `redirect` parameter. Prior to the fix, the redirect parameter was not properly validated before navigation, enabling XSS attacks through malicious redirect values. The remediation implements `isValidRedirectPath()` validation that explicitly blocks `javascript:`, `data:`, and cross-origin redirect attempts.

Defensive priority

low

Recommended defensive actions

  • Upgrade Teable to version release.2026-04-21T08-57-20Z.1513 or later to obtain the fix for the login redirect validation
  • Review and validate any custom redirect handling implementations in authentication flows
  • Implement Content Security Policy (CSP) headers as defense-in-depth against XSS vectors
  • Monitor for and block suspicious redirect parameters containing javascript:, data:, or unexpected external URLs in web application firewalls

Evidence notes

CVE published 2026-05-26. Vendor confirmation of fix via GitHub pull request and release tag. CVSS 4.0 vector indicates network attack vector with user interaction required, low integrity impact. CWE-79 (XSS) and CWE-94 (Code Injection) identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9566 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9566

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9566 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9566

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.