Description (CNA)
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Gitea / Gitea | affected 1.27.0 through 1.27.1 |
CWE
CWE-79, CWE-1021
References
- https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8
- https://github.com/go-gitea/gitea/pull/38793
- https://blog.gitea.com/release-of-1.27.2/
- https://github.com/go-gitea/gitea/pull/38795
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2
ADP enrichment
No English description supplied.
No references supplied.