CVE-2026-60008
CVE-2026-60008 · Gitea Jupyter notebook UI redress through CSS class injection
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.
CVSS 3.5 · Niedrig · EPSS 0,4%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
gitea
- Softwareversionen
- ≥ 1.27.0, ≤ 1.27.1: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8
- https://github.com/go-gitea/gitea/pull/38793
- https://blog.gitea.com/release-of-1.27.2/
- https://github.com/go-gitea/gitea/pull/38795
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-60008