PT-2026-43372 · Tenable · Tenable

Trebledj · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-9566

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions teableio teable versions prior to release.2026-04-21T08-57-20Z.1513

Description Cross site scripting can be triggered remotely through the manipulation of the redirect argument within the Sign-up component of the file apps/nextjs-app/src/features/auth/pages/LoginPage.tsx. The issue occurs because the login redirect flow failed to properly validate the redirect path, allowing the execution of javascript:, data:, and cross-origin redirects.

Recommendations Upgrade to version release.2026-04-21T08-57-20Z.1513. As a temporary workaround, restrict or validate the redirect parameter used during the login process to prevent the use of javascript:, data:, or cross-origin URIs.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-9566

Affected Products

Tenable

References · 11

• 🔥 https://gist.github.com/TrebledJ/98575dc5aecb47433f02ff942e6aedf1 · Exploit
• https://github.com/teableio/teable/releases/tag/release.2026-04-21T08-57-20Z.1513 · Patch
• https://github.com/Teableio/Teable/pull/2827 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9566 · Security Note
• https://vuldb.com/vuln/365628/cti · Note
• https://vuldb.com/vuln/365628 · Note
• https://github.com/Teableio/Teable · Note
• https://twitter.com/CVEnew/status/2059337199099732324 · Twitter Post
• https://t.me/CVEtracker/55007 · Telegram Post
• https://vuldb.com/submit/815798 · Note
• https://twitter.com/infoflowcloud/status/2059337726990651643 · Twitter Post