This vulnerability in Mage AI up to version 0.9.79 involves improper handling of the query.redirect_url parameter in the useMutation function within the mage_ai/frontend/components/Sessions/SignForm/index.tsx file. An attacker can manipulate this argument to inject malicious scripts, resulting in cross-site scripting (XSS). The vulnerability is remotely exploitable and the exploit code is publicly available. The vendor has not issued a fix or advisory as of the publication date.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the victim's browser session during the sign-in flow. This can lead to session hijacking, credential theft, or other malicious actions that rely on executing unauthorized scripts. The CVSS 4.0 base score is 5.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing temporary mitigations such as input validation and output encoding on the redirect_url parameter if possible. Monitor official Mage AI channels for updates or patches addressing this issue.