Gitpod vulnerable to Cross-site Scripting

MEDIUM 6.1CVE-2023-32766 · GHSA-gqx9-h3w2-fprg · Published 05/06/2023 · updated 17/06/2026

In short

CVE-2023-32766 is a MEDIUM (CVSS 6.1) vulnerability affecting github.com/gitpod-io/gitpod, gitpod (gitpod).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.5% of all vulnerabilities.
Fix: update to 2022.11.3 or later.

Package	Affected versions	Patched versions
github.com/gitpod-io/gitpod Go	`< 2022.11.3`	`2022.11.3`
gitpod gitpod	`< 2022.11.3`	`2022.11.3`

Description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

NVD description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

References

nvd.nist.gov/vuln/detail/CVE-2023-32766 · ADVISORY
gitpod-io/gitpod#17559 · WEB
gitpod-io/gitpod commit 6771283 · WEB
app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview · WEB
gitpod-io/gitpod · PACKAGE
gitpod-io/gitpod · WEB
gitpod-io/gitpod release 2022.11.3 · WEB
gitpod.io · WEB

More vulnerabilities in github.com/gitpod-io/gitpod

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free