UI Redress Vulnerability in Gitea's Jupyter Notebook Renderer

CVE-2026-60008

What is CVE-2026-60008?

The Jupyter notebook renderer in Gitea is vulnerable due to the inclusion of untrusted language_info.name metadata into a CSS class attribute without proper sanitization. This flaw allows malicious notebooks to include multiple CSS classes, potentially creating a viewport-covering overlay that can intercept user clicks when viewed by other users. While script execution hasn’t been demonstrated, the potential for UI manipulation poses significant risks.

References