This vulnerability in GitHub Enterprise Server involves improper neutralization of input during web page generation (CWE-79). An authenticated attacker can inject a crafted payload into the title of a Discussion in the Q&A category, which is not properly escaped before being embedded in a <script type="application/ld+json"> block. This allows the injected payload to break out of the script context. The attack is escalated to a full cross-site scripting exploit by leveraging JSONP callback support in the REST API to bypass the Content Security Policy. The vulnerability affects all versions prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.

An authenticated attacker can execute arbitrary JavaScript in the browsers of other users, potentially leading to session hijacking, unauthorized actions, or data exposure within the context of GitHub Enterprise Server. The vulnerability bypasses Content Security Policy protections via JSONP callback support, increasing the risk of successful exploitation.

Fixes for this vulnerability are available in GitHub Enterprise Server versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation requires applying these official patches. Patch status is confirmed by the vendor advisory embedded in the description.