An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a user, while operating in sudo mode, to click on a crafted malicious link to perform actions that require elevated privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.1, 3.17.7, 3.16.10, 3.15.14, 3.14.19.
Fix
Patch, vendor advisory and mitigation references on NVD 5
- https://docs.github.com/en/[email protected]/admin/release-notes#3.14.19 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.15.14 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.16.10 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.17.7 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.18.1 Release Notes, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.6 · githubNVD modified 2026-10-18 21:10
Affected (CPE criteria) 2
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*cpe:2.3:a:github:enterprise_server:3.18.0:*:*:*:*:*:*:*
References 5
- https://docs.github.com/en/[email protected]/admin/release-notes#3.14.19 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.15.14 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.16.10 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.17.7 Release Notes, Vendor Advisory
- https://docs.github.com/en/[email protected]/admin/release-notes#3.18.1 Release Notes, Vendor Advisory