GHSA-6vxv-wg6j-5qwp: Gogs: XSS in .ipynb files renderer due to outdated notebookjs

June 19, 2026

Gogs renders Jupyter notebook files (.ipynb) using jsvine/notebookjs, but the version is outdated, missing patches for known XSS vulnerabilities.

References

github.com/advisories/GHSA-6vxv-wg6j-5qwp
github.com/gogs/gogs/security/advisories/GHSA-6vxv-wg6j-5qwp

Code Behaviors & Features

Detect and mitigate GHSA-6vxv-wg6j-5qwp with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →