This vulnerability exists in Mage AI up to version 0.9.79 within the frontend component handling the sign-in flow. The issue arises from improper handling of the query.redirect_url parameter in the useMutation function, leading to cross-site scripting. An attacker can remotely exploit this by crafting malicious input to execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has been contacted but has not issued a patch or advisory, and no remediation level is specified.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the user's browser, potentially resulting in session hijacking, credential theft, or other malicious actions within the context of the Mage AI application. Since the vulnerability is in the sign-in flow, it may impact user authentication processes. The exploit is publicly available, increasing the risk of attacks. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing input validation or sanitization on the query.redirect_url parameter as a temporary mitigation. Monitoring for updates from the vendor is critical to apply an official fix once available.