CVE-2025-11892
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-12-08
Assigner: GitHub, Inc. (Products Only)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| github | enterprise_server | to 3.14.19 (exc) |
| github | enterprise_server | From 3.15.0 (inc) to 3.15.14 (exc) |
| github | enterprise_server | From 3.16.0 (inc) to 3.16.10 (exc) |
| github | enterprise_server | From 3.17.0 (inc) to 3.17.7 (exc) |
| github | enterprise_server | 3.18.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper neutralization of input in GitHub Enterprise Server that allows DOM-based cross-site scripting (XSS) via the Issues search label filter. An attacker with access to the target GitHub Enterprise Server instance can craft a malicious link that, when clicked by a user operating in sudo mode, can lead to privilege escalation and unauthorized workflow triggers.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to escalate privileges and trigger unauthorized workflows on the GitHub Enterprise Server. This could lead to unauthorized actions being performed with elevated privileges, potentially compromising the security and integrity of the server and its workflows.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade your GitHub Enterprise Server to version 3.18.1, 3.17.7, 3.16.10, 3.15.14, or 3.14.19 or later, as these versions contain the fix for the issue. Additionally, avoid clicking on untrusted or suspicious links while operating in sudo mode to prevent exploitation.