A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's browser by injecting a crafted payload into the title of a Discussion in the Q&A category. The AnsweredQuestionStructuredDataComponent did not escape user-controlled Discussion titles before embedding them in a <script type="application/ld+json"> block, allowing the title to break out of the script context. The injection was escalated to a full cross-site scripting attack on GitHub Enterprise Server by leveraging JSONP callback support in the REST API to bypass the Content Security Policy. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The
Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying that the requesting user was authorized to view
the target repository. Exploitation required an authenticated account on the instance with read access to at least one repository to use as the comparison base. This vulnerability affected all
versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHub Bug Bounty program.
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management. An attacker could exploit this by creating an OAuth application requesting the manage_runners:org scope and directing a victim user to authorize it, as the scope was not displayed on the authorization consent screen. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens. This vulnerability is fixed in 1.1.2.
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.2. This vulnerability was reported via the GitHub Bug Bounty program.
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and measuring response timing, an attacker could infer the values of sensitive environment variables, including signing secrets and private keys. Exploitation required GitHub Packages to be enabled; on instances not running in private mode the vulnerability was exploitable without authentication, otherwise any authenticated user could exploit it. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21.1 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19. This vulnerability was reported via the GitHub Bug Bounty program.
GitHub Copilot CLI versions prior to 1.0.43 contain a high-severity vulnerability (CVE-2026-45033) that allows arbitrary code execution. This occurs when a malicious bare git repository is nested inside a project directory, exploiting git's automatic bare repository discovery during directory traversal. The vulnerability leverages git configuration keys such as core.fsmonitor and others that can execute arbitrary shell commands during normal git operations. This issue is fixed in version 1.0.43.
CVE-2026-8106 is a reflected cross-site scripting (XSS) vulnerability in the GitHub Enterprise Server Management Console login page. The issue arises from improper sanitization of the redirect_to query parameter on the /setup/unlock endpoint, allowing injection of malicious HTML elements. An attacker could exploit this by tricking an administrator into clicking a crafted link and entering credentials, potentially leading to credential theft. This vulnerability affects GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.
CVE-2026-8034 is a server-side request forgery (SSRF) vulnerability in the GitHub Enterprise Server notebook viewer. It arises from a discrepancy between the URL parser used for hostname validation and the one used by the HTTP request library, allowing crafted URLs to bypass validation and access unintended internal hosts. This vulnerability affects all GitHub Enterprise Server versions prior to 3.21 and requires network access to the server instance for exploitation. It has a high severity with a CVSS score of 7.9. Fixes were released in versions 3.16.18, 3.17.
CVE-2026-7541 is a denial of service vulnerability in GitHub Enterprise Server versions prior to 3.21. An unauthenticated attacker can send crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint, causing excessive CPU and memory consumption due to lack of size or depth limits in JSON parsing. This leads to service disruption. The issue was fixed in versions 3.20.2, 3.19.6, 3.18.
CVE-2026-6736 is an authentication bypass vulnerability in GitHub Enterprise Server versions prior to 3.21. It allows an unauthenticated attacker to create a local user account despite external identity provider enforcement. The vulnerability occurs because the signup endpoint does not properly enforce authentication restrictions when external authentication is enabled. The attacker can establish a session with default base permissions on the instance. Exploitation requires network access to a vulnerable GitHub Enterprise Server instance configured with an external authentication provider. The issue was fixed in versions 3.20.2, 3.19.
CVE-2026-5845 is an authorization bypass vulnerability in GitHub Enterprise Server affecting versions prior to 3.21. It allows an authenticated attacker to access private repositories outside the intended installation scope, potentially including write operations. The issue arises from an authorization fallback treating a revoked or deleted installation as a global installation context. This can be exploited by chaining token revocation timing and SSH push attribution to reuse a victim-scoped token. The vulnerability has a high severity score of 7.2 and was fixed in versions 3.20.1 and later. No known exploits in the wild have been reported.
CVE-2026-3307 is an authorization bypass vulnerability in GitHub Enterprise Server versions prior to 3.21. It allows an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter. The vulnerability does not permit adding arbitrary external users, only assigning existing trusted users as bypass reviewers. This issue was fixed in multiple patched versions starting from 3.14.25 and later. The CVSS 4.0 score is 5.3, indicating a medium severity level.
CVE-2026-5512 is an improper authorization vulnerability in GitHub Enterprise Server prior to version 3.21. It allows an authenticated attacker to discover the names of private repositories by their numeric IDs due to insufficient authorization checks in the mobile upload policy API endpoint. Validation error messages exposed full repository names even when the caller lacked access. This issue was fixed in versions 3.20.1 and later. The vulnerability has a medium severity rating with a CVSS score of 5.3 and was reported through the GitHub Bug Bounty program.
CVE-2026-4296 is a high-severity vulnerability in GitHub Enterprise Server involving an incorrect regular expression that allowed bypassing OAuth redirect URI validation. An attacker who knows a legitimate OAuth application's callback URL could craft a malicious authorization link to redirect OAuth authorization codes to attacker-controlled domains. This could enable unauthorized access to victim accounts with the OAuth application's granted scopes. The issue affects all GitHub Enterprise Server versions prior to 3.21 and was fixed in versions 3.20.1 and later. No known exploits in the wild have been reported.
CVE-2026-5921 is a high-severity server-side request forgery (SSRF) vulnerability in GitHub Enterprise Server affecting versions prior to 3.21. It allows an unauthenticated attacker to extract sensitive environment variables via a timing side-channel attack on the notebook rendering service when private mode is disabled. The vulnerability involves following HTTP redirects without revalidating the destination host, enabling SSRF to internal services. Exploitation requires chaining an open redirect endpoint through an external redirect to internal services. The issue was fixed in versions 3.14.26, 3.15.21, 3.
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.16.15, 3.17.12, 3.18.6 and 3.19.3. This vulnerability was reported via the GitHub Bug Bounty program.