Is there a public PoC exploit available for EUVD-2026-31906?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31906. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for EUVD-2026-31906?

Yes, a patch is available for EUVD-2026-31906. Update the affected software to the latest version immediately.

Teable EUVD-2026-31906

Q: What is the CVSS score of EUVD-2026-31906?

EUVD-2026-31906 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9566 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-26 VulDB

GHSA-6mmc-c65c-3cjp

XSS Teable

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 13:39 vuln.today

Analysis Generated

Jun 08, 2026 - 13:39 vuln.today

Severity Changed

May 26, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 18:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in teableio teable up to 1.9.x. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.tsx of the component Sign-up. The manipulation of the argument redirect leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version release.2026-04-21T08-57-20Z.1513 will fix this issue. The affected component should be upgraded. The vendor confirms: "The default branch of teableio/teable is develop, and the reported login redirect issue has already been fixed there. The login redirect flow now validates the redirect parameter with isValidRedirectPath() before navigation, which blocks javascript:, data:, and cross-origin redirects."

AnalysisAI

Cross-site scripting in Teable's authentication redirect flow (versions 1.0-1.9.x) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by crafting a login URL with a malicious redirect parameter using javascript: or data: URI schemes. The vulnerable component is LoginPage.tsx in the Next.js frontend and the social auth controller adapter in the NestJS backend, neither of which validated the redirect destination before navigating. Publicly available exploit code exists (GitHub gist), but the vulnerability is not listed in CISA KEV and EPSS probability is very low at 0.04% (11th percentile), indicating no confirmed widespread exploitation.

Technical ContextAI

Teable is an open-source Airtable alternative built on a monorepo stack: a Next.js frontend (apps/nextjs-app) and a NestJS backend (apps/nestjs-backend). The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS rooted in the absence of redirect URI validation in the authentication flow. Both the sign-up/login page (apps/nextjs-app/src/features/auth/pages/LoginPage.tsx) and the social OAuth adapter (apps/nestjs-backend/src/features/auth/social/controller.adapter.ts) accepted the redirect query parameter and forwarded users to it post-authentication without sanity-checking the scheme or origin. This allowed javascript: and data: URIs to be used as redirect targets, causing the browser to execute attacker-controlled code in the authenticated user's session context. The CPE string cpe:2.3:a:teableio:teable:*:*:*:*:*:*:*:* covers all versions through 1.9.x.

RemediationAI

Upgrade to the vendor-released patch version release.2026-04-21T08-57-20Z.1513, available at https://github.com/teableio/teable/releases/tag/release.2026-04-21T08-57-20Z.1513. The fix introduces an isValidRedirectPath() validation function in both the NestJS social auth controller adapter and the Next.js SocialAuth component; it parses the redirect URI against a placeholder base origin and rejects any URL whose resolved origin does not match the application's own origin or whose scheme is not http or https, effectively blocking javascript:, data:, and cross-origin redirect payloads. The upstream patch PR is at https://github.com/Teableio/Teable/pull/2827. If an immediate upgrade is not possible, operators can deploy a web application firewall rule or reverse-proxy filter that strips or rejects redirect query parameters containing non-http/https schemes (javascript:, data:, vbscript:) on requests to /login and /signup endpoints. This workaround reduces exposure without eliminating the root cause, and care must be taken not to block legitimate same-origin redirect values needed for post-login navigation.