CVE-2026-60008

Deferred Deferred - Pending Action

Jupyter Notebook UI Redress in Gitea

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-60008

EUVD

EUVD-2026-101282

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.27.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Attack-Flow Graph

Executive Summary

CVE-2026-60008 is a vulnerability in Gitea's Jupyter notebook renderer where attacker-controlled CSS classes are injected into unsanitized output without sandboxing. The renderer disables sanitization but fails to restrict malicious CSS, allowing an attacker with repository write access to inject classes that could cover the viewport or intercept user clicks. Script execution is not possible due to frontend protections.

Detection Guidance

Check Gitea version with: gitea --version. If running 1.27.0 or 1.27.1, the system is vulnerable. Inspect Jupyter notebooks in repositories for unexpected CSS classes in rendered output.

Impact Analysis

This vulnerability allows an attacker to create a malicious Jupyter notebook in a repository you access. When you view the notebook, the injected CSS could overlay the entire page or capture your clicks, potentially tricking you into interacting with hidden elements. While direct code execution is blocked, the UI can be manipulated to deceive users.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it does not involve unauthorized data access, disclosure, or processing violations. The issue is limited to UI redress through malicious CSS injection, which could manipulate user interactions but does not lead to script execution or data breaches.

Mitigation Strategies

Upgrade Gitea to version 1.27.2 or later. Disable Jupyter notebook rendering for untrusted repositories if upgrading is not immediately possible.

Hi! I’m here to help you understand CVE-2026-60008. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70