CVE-2026-60008

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The Jupyter notebook renderer inserts the language info.name metadata into a CSS class attribute. This process disables sanitization and renders the content directly in the main document without using an iframe sandbox. A malicious notebook can provide multiple CSS classes to create an overlay that covers the viewport and intercepts user clicks, leading to UI redress. Script execution was not demonstrated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.