Cross-site scripting in Gitea - CVE-2026-60008
Published: August 15, 2026
Vulnerability identifier: #VU142692
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-60008
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to display arbitrary full-screen content on the Gitea origin and intercept clicks.
The vulnerability exists due to improper neutralization of input during web page generation in the Jupyter notebook renderer when rendering a crafted notebook with attacker-controlled language metadata into unsanitized, unsandboxed output. A remote user can commit or upload a specially crafted notebook file to display arbitrary full-screen content on the Gitea origin and intercept clicks.
Exploitation requires write access to the repository containing the notebook, and users must open the affected repository page or rendered notebook content.
Affected software
Gitea
How to mitigate CVE-2026-60008
Install security update from vendor's website.
Gitea - update to 1.27.2