GHSA-gqx9-h3w2-fprg

Gitpod vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-32766

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/gitpod-io/gitpod	< 2022.11.3	2022.11.3

Details

As written in the advisory (Markdown source, shown as plain text).

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-32766 advisory
https://github.com/gitpod-io/gitpod/pull/17559 web
https://github.com/gitpod-io/gitpod/commit/6771283c3406586e352337675b79ff2ca50f191b web
https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=default&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d web
https://github.com/gitpod-io/gitpod package
https://github.com/gitpod-io/gitpod/compare/release-2022.11.2...2022.11.3 web
https://github.com/gitpod-io/gitpod/releases/tag/2022.11.3 web
https://www.gitpod.io web