{"id":"CVE-2026-60008","published":"2026-10-14T15:17:20.787","lastModified":"2026-10-14T16:17:47.170","description":"Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.","cvssScore":3.5,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","cwes":["CWE-79","CWE-1021"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38793","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38795","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/38793","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38795","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8","tags":[]}],"hasPoc":true,"ai":null}