CVE-2026-60008 Details
Description
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.
A vulnerability in Gitea's Jupyter notebook renderer allows for UI redress by inserting untrusted metadata into a CSS class attribute without proper sanitization. This issue is present in Gitea versions 1.27.0 through 1.27.1. The vulnerability arises because the renderer disables the sanitizer and renders directly into the main document, bypassing security controls. As a result, a malicious notebook can add multiple CSS classes that create a viewport-covering overlay, intercepting clicks when the repository page is viewed.
Users can upgrade to Gitea version 1.27.2, which addresses this vulnerability. For those unable to upgrade, it is recommended to avoid rendering or serving untrusted Jupyter notebooks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.2/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/38793 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/38795 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8 | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | Gitea Limited |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.27.0, <= 1.27.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |