A critical server-side request forgery (SSRF) vulnerability exists in the GitHub Enterprise Server notebook viewer. It arises from a discrepancy between the URL parser used for hostname validation and the HTTP request library, allowing crafted URLs to bypass validation and access unintended internal hosts. This affects all GitHub Enterprise Server versions prior to 3.21. The issue requires network access to the server instance to exploit and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2.