VulnerabilityDeferred

CVE-2026-60008

A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it.

LOW 3.5EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.37% probability · 31th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79, CWE-1021
Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

EPSS trend

EPSS moved from 0.4% on 15 October 2026 to 0.4% on 26 October 2026.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.