CVE-2026-60008
CVE-2026-60008 · Gitea Jupyter notebook UI redress through CSS class injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.
CVSS 3.5 · Low · EPSS 0.4%
- Published
- Updated
Affected products and versions
gitea
- Versions
- ≥ 1.27.0, ≤ 1.27.1: Affected (semver)
No fix published
Original sources
- https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8
- https://github.com/go-gitea/gitea/pull/38793
- https://blog.gitea.com/release-of-1.27.2/
- https://github.com/go-gitea/gitea/pull/38795
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-60008