CVE-2026-60008: notebook CSS class injection enables

CISO Take

Gitea's Jupyter notebook renderer places the notebook's language_info.name metadata into a CSS class attribute with sanitization disabled and no iframe sandbox, so a malicious repository notebook can draw a viewport-covering overlay that hijacks clicks (clickjacking/UI redress). The reported impact is limited to UI redress, since script execution was not demonstrated. No CVSS score, EPSS value, KEV listing, public exploit or Nuclei template exists, so near-term exploitation pressure looks low. The risk is highest for organizations that host ML notebooks and shared experiments on self-hosted Gitea, where a repository contributor could trick colleagues into clicking something unintended. Upgrade to Gitea 1.27.2, which contains the fix, and review untrusted notebook repositories in the meantime.

Sources:NVDGitHub Advisoryblog.gitea.comATLAS

What is the risk?

Low to moderate. Exploitation needs a crafted notebook in a repository that the victim can view, plus a victim click. Impact is confined to UI redress and there is no demonstrated script execution, data theft or privilege escalation. No severity score, EPSS, KEV or public exploit data is available (all N/A), so confidence in the risk rating is MEDIUM. The CWE-79 mapping suggests the class could be raised later if script execution is found, so the rating should be revisited if further analysis appears.

How does the attack unfold?

Initial Access

Attacker commits a notebook with a crafted language_info.name value to a repository the victim can access.

AML.T0011.003

Exploitation

The Gitea renderer inserts the value into a CSS class attribute without sanitization or an iframe sandbox, creating a full-viewport overlay.

Impact

The victim's clicks are intercepted, so they trigger unintended actions in the Gitea UI.

Initial Access

Attacker commits a notebook with a crafted language_info.name value to a repository the victim can access.

AML.T0011.003

Exploitation

The Gitea renderer inserts the value into a CSS class attribute without sanitization or an iframe sandbox, creating a full-viewport overlay.

Impact

The victim's clicks are intercepted, so they trigger unintended actions in the Gitea UI.

How severe is it?

CVSS 3.1

3.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CLow

INone

ANone

What should I do?

5 steps

Upgrade Gitea to 1.27.2 or later (see the release notes and GHSA-7452-653r-6gp8).
Until patched, restrict who can push or fork repositories containing notebooks, and warn users against opening notebooks from untrusted or external contributors.
Consider a reverse-proxy Content-Security-Policy and X-Frame-Options that limit what rendered content can do.
Review recently added .ipynb files for unusual language_info.name values containing multiple space-separated tokens or utility-style CSS class names.
Enforce re-authentication or confirmation on sensitive Gitea actions and require MFA for administrators.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Social EngineeringFrameworkAML.T0011.003- Malicious Link

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Risk treatment and response for identified AI risks

Frequently Asked Questions

What is CVE-2026-60008?

Gitea's Jupyter notebook renderer places the notebook's language_info.name metadata into a CSS class attribute with sanitization disabled and no iframe sandbox, so a malicious repository notebook can draw a viewport-covering overlay that hijacks clicks (clickjacking/UI redress). The reported impact is limited to UI redress, since script execution was not demonstrated. No CVSS score, EPSS value, KEV listing, public exploit or Nuclei template exists, so near-term exploitation pressure looks low. The risk is highest for organizations that host ML notebooks and shared experiments on self-hosted Gitea, where a repository contributor could trick colleagues into clicking something unintended. Upgrade to Gitea 1.27.2, which contains the fix, and review untrusted notebook repositories in the meantime.

Is CVE-2026-60008 actively exploited?

No confirmed active exploitation of CVE-2026-60008 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60008?

1. Upgrade Gitea to 1.27.2 or later (see the release notes and GHSA-7452-653r-6gp8). 2. Until patched, restrict who can push or fork repositories containing notebooks, and warn users against opening notebooks from untrusted or external contributors. 3. Consider a reverse-proxy Content-Security-Policy and X-Frame-Options that limit what rendered content can do. 4. Review recently added .ipynb files for unusual language_info.name values containing multiple space-separated tokens or utility-style CSS class names. 5. Enforce re-authentication or confirmation on sensitive Gitea actions and require MFA for administrators.

What systems are affected by CVE-2026-60008?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model development workflows, notebook-based experimentation, source code and artifact repositories.

What is the CVSS score for CVE-2026-60008?

CVE-2026-60008 has a CVSS v3.1 base score of 3.5 (LOW). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel development workflowsnotebook-based experimentationsource code and artifact repositories

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.

Exploitation Scenario

An attacker with write access to a shared ML project, or a fork submitted through a pull request, commits a notebook whose language_info.name holds several CSS classes that make a transparent full-screen overlay. When a maintainer or data scientist opens the notebook in the Gitea web view, the overlay captures their clicks. The attacker positions it over a sensitive control, such as a merge, approve or delete action, so the victim triggers it unknowingly. This could let a malicious change enter an ML pipeline repository. Only UI redress is reported, not script execution.

Weaknesses (CWE)

CWE-1021Improper Restriction of Rendered UI Layers or Frames CWE-1021Improper Restriction of Rendered UI Layers or Frames CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1021 — Improper Restriction of Rendered UI Layers or Frames: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

[Implementation] The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multiple domains.
[Implementation] A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does not intuitively account for multiple nested frames that can be presented to the user.

Source: MITRE CWE corpus.