CVE-2026-77912 is a stored XSS vulnerability in GitHub Enterprise Server's Markdown rendering pipeline. Authenticated attackers could inject crafted Markdown that abuses same-origin JavaScript gadgets to bypass Content Security Policy by exploiting the rewriting of quote characters in sanitized HTML without re-sanitization. This allows attackers to manipulate the DOM of pages viewed by other users, potentially reading sensitive content, extracting CSRF tokens, performing state-changing actions on behalf of victims, and exfiltrating data. The payload can propagate across repositories and organizations with victim write access. The vulnerability affects supported releases in the 3.17 through 3.22 series and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.

Successful exploitation allows an authenticated attacker to execute stored cross-site scripting attacks that can bypass Content Security Policy, read content visible to victims, extract embedded CSRF tokens, perform unauthorized state-changing actions as the victim, and exfiltrate data. The payload can also spread to other repositories and organizations where the victim has write access, increasing the attack surface and potential impact.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated beyond applying the official patches.