A vulnerability exists in Mage AI up to version 0.9.79 in the Sign‑in Flow component. The useMutation function in mage_ai/frontend/components/Sessions/SignForm/index.tsx allows an attacker to manipulate the query.redirect_url parameter, which is rendered without proper sanitization, leading to cross‑site scripting (XSS). This flaw enables a remote attacker to inject arbitrary JavaScript that will run in the context of a victim’s browser when they follow the forged redirect_url.

All installations of Mage AI that are running a version earlier than or equal to 0.9.79 are affected. The vulnerability resides in the front‑end component accessed by users attempting to sign in and is not limited to specific modules beyond the Sign‑in Flow. The vendor is Mage AI and no other products are listed.

The CVSS base score of 5.3 indicates a medium severity vulnerability. The EPSS score is not available, yet the exploit is publicly disclosed and can be performed remotely by sending a crafted redirect_url URL in a sign‑in request. Because the flaw is an XSS, it defers to the victim’s authentication state, but any user who clicks the manipulated link or submits the form will receive the injected script, potentially allowing credential theft or session hijacking. The vulnerability is not in CISA’s KEV catalog, but its public availability and lack of vendor response increase the likelihood that attackers will target exposed Mage AI instances.