CVE-2026-77912
A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. Crafted Markdown could abuse same-origin JavaScript gadgets to bypass Content Security Policy and gain control of the page DOM when viewed by another user. Successful exploitation could allow an attacker to read content visible to the victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes. The payload could also propagate to repositories and organizations where the victim had write access. This vulnerability affected supported GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported via the GitHub Bug Bounty program.
- CVSS 4.0
- 7.4 HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.21% probability · 11th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- github/enterprise server
- Source
- product-cna@github.com
EPSS moved from 0.4% on 23 September 2026 to 0.2% on 26 October 2026.
References
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.21Release Notes, Vendor Advisory
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.15Release Notes, Vendor Advisory
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.12Release Notes, Vendor Advisory
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.8Release Notes, Vendor Advisory
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.6Release Notes, Vendor Advisory
- https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.1Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.