CVE-2026-60008
CVE-2026-60008 · Gitea Jupyter notebook UI redress through CSS class injection
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.
CVSS 3.5 · Baja · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
gitea
- Versiones
- ≥ 1.27.0, ≤ 1.27.1: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8
- https://github.com/go-gitea/gitea/pull/38793
- https://blog.gitea.com/release-of-1.27.2/
- https://github.com/go-gitea/gitea/pull/38795
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-60008