Gitpod vulnerable to Cross-site Scripting

MEDIO 6.1CVE-2023-32766 · GHSA-gqx9-h3w2-fprg · Published 05/06/2023 · updated 17/06/2026

En resumen

CVE-2023-32766 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a github.com/gitpod-io/gitpod, gitpod (gitpod).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.56%, mayor que el 46.5% de las vulnerabilidades.
Solución: actualizar a 2022.11.3 o posterior.

Package	Affected versions	Patched versions
github.com/gitpod-io/gitpod Go	`< 2022.11.3`	`2022.11.3`
gitpod gitpod	`< 2022.11.3`	`2022.11.3`

Description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

NVD description

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

References

nvd.nist.gov/vuln/detail/CVE-2023-32766 · ADVISORY
gitpod-io/gitpod#17559 · WEB
gitpod-io/gitpod commit 6771283 · WEB
app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview · WEB
gitpod-io/gitpod · PACKAGE
gitpod-io/gitpod · WEB
gitpod-io/gitpod release 2022.11.3 · WEB
gitpod.io · WEB

Más vulnerabilidades de github.com/gitpod-io/gitpod

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free