A cross‑site scripting flaw was discovered in Teable’s login page, where an attacker may manipulate the redirect argument to embed malicious JavaScript. The vulnerability can lead to execution of arbitrary code in the victim’s browser, potentially allowing session hijacking, credential theft, or defacement. It exploits a classic CWE‑79 input validation error, triggered by unfiltered redirect URLs that include javascript: or data: schemes.

The issue affects Teable versions up to 1.9.x. The product is Teable, a cloud‑based data management platform. The fix is released in version release.2026-04-21T08-57-20Z.1513 and later releases have applied validation to the redirect parameter.

With a CVSS score of 5.3 the flaw presents moderate risk; the EPSS score is unavailable and it is not listed in CISA’s KEV catalogue, though publicly available exploits have been reported. The attack is remotely exploitable by directing users to a crafted login URL and can be performed without privileged access. The vulnerability’s effectiveness depends on the attacker’s ability to send users to a malicious redirect, making it a reach‑out threat for phishing or social‑engineering campaigns.