CVE-2026-9566: Teableio Teable XSS Vulnerability

CVE-2026-9566 Overview

CVE-2026-9566 is a reflected cross-site scripting (XSS) vulnerability in the teableio teable application affecting versions up to 1.9.x. The flaw resides in the Sign-up component, specifically in apps/nextjs-app/src/features/auth/pages/LoginPage.tsx, where the redirect parameter is processed without proper validation. An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript in the victim's browser. The issue is tracked under CWE-79 and has been publicly disclosed with proof-of-concept code available.

Critical Impact
Remote attackers can deliver JavaScript payloads through the login redirect parameter, enabling session theft, credential harvesting, or unauthorized actions within the authenticated user's context.

Affected Products

teableio teable versions up to and including 1.9.x
Component: Sign-up / Login page (LoginPage.tsx)
Fixed in release release.2026-04-21T08-57-20Z.1513

Discovery Timeline

2026-05-26 - CVE-2026-9566 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9566

Vulnerability Analysis

The vulnerability is a client-side reflected XSS issue in the Teable login flow. The LoginPage.tsx component reads the redirect query parameter from the URL and uses it for navigation after authentication. Because the parameter is not validated against a safe-URL allow list, an attacker can supply a javascript: URI, a data: URI, or a cross-origin URL. When the redirect is processed, the browser executes the attacker-controlled payload in the context of the Teable origin. Successful exploitation requires user interaction, typically clicking a crafted link.

Root Cause

The root cause is missing input validation on the redirect parameter prior to navigation. The pre-patch code path did not enforce scheme or origin checks, treating any string as a valid redirect target. The vendor's fix introduces an isValidRedirectPath() helper that rejects javascript:, data:, and cross-origin URLs before any navigation occurs.

Attack Vector

Exploitation is remote and network-based. An attacker crafts a URL pointing to the Teable login page with a malicious redirect value, for example a javascript: URI containing an arbitrary payload. The attacker then delivers this URL through phishing, social media, or any channel where a victim might click it. Once the victim authenticates or interacts with the page, the redirect logic triggers script execution. Verified proof-of-concept code is published in a public GitHub Gist; see the GitHub Gist PoC and the vendor patch pull request for technical details.

Detection Methods for CVE-2026-9566

Indicators of Compromise

HTTP requests to the Teable login endpoint containing a redirect parameter with values starting with javascript:, data:, or vbscript: schemes.
Login URLs whose redirect value points to an external origin that does not match the Teable deployment domain.
Browser console errors or unexpected script execution originating from the Teable login page.

Detection Strategies

Inspect web server and reverse-proxy logs for login URLs containing URL-encoded javascript%3A or data%3A substrings in the redirect query parameter.
Deploy a web application firewall rule that flags or blocks requests to authentication endpoints when the redirect parameter contains non-relative URL schemes.
Review browser telemetry and endpoint EDR data for unusual script execution events tied to the Teable application origin.

Monitoring Recommendations

Enable verbose access logging on the Teable front end and centralize logs for query string analysis.
Alert on repeated login requests from a single source carrying suspicious redirect payloads, which can indicate scanning or exploitation attempts.
Track outbound referrer patterns from the Teable login page to identify users who arrived via tampered links.

How to Mitigate CVE-2026-9566

Immediate Actions Required

Upgrade Teable to release release.2026-04-21T08-57-20Z.1513 or later, which contains the isValidRedirectPath() validation fix.
Audit existing Teable deployments to confirm the patched build is running and that no forked or customized login flow reintroduces the issue.
Notify users of the application and warn them against clicking unsolicited login links containing unusual redirect parameters.

Patch Information

The vendor fixed this issue in the develop branch and shipped it in release release.2026-04-21T08-57-20Z.1513. The fix validates the redirect parameter with isValidRedirectPath() before navigation, blocking javascript:, data:, and cross-origin redirects. See the Teable release notes and the merged pull request #2827 for the code changes.

Workarounds

If immediate upgrade is not possible, place the Teable login endpoint behind a reverse proxy or WAF rule that strips or rejects redirect parameters containing non-relative URLs.
Enforce a strict Content Security Policy (CSP) on the Teable application that disallows inline script execution and restricts script sources to trusted origins.
Restrict access to the Teable application to authenticated network segments where feasible to reduce the population of users exposed to phishing-delivered links.

bash

# Example nginx rule to block javascript: and data: schemes in the redirect parameter
location /auth/login {
    if ($arg_redirect ~* "^(javascript|data|vbscript):") {
        return 400;
    }
    proxy_pass http://teable_backend;
}