BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-19

Assigner: GitHub, Inc. (Products Only)

Description

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-11

Last Modified

2025-12-19

Generated

2026-07-06

AI Q&A

2025-12-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14046

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	to 3.14.21 (exc)
github	enterprise_server	From 3.15.0 (inc) to 3.15.16 (exc)
github	enterprise_server	From 3.16.0 (inc) to 3.16.12 (exc)
github	enterprise_server	From 3.17.0 (inc) to 3.17.9 (exc)
github	enterprise_server	From 3.18.0 (inc) to 3.18.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in GitHub Enterprise Server involves improper neutralization of user-supplied HTML input, which allows injection of DOM elements with IDs that conflict with server-initialized data islands. These ID collisions can overwrite or shadow important application state objects in certain Project views, potentially causing unintended server-side POST requests or unauthorized backend interactions. Exploitation requires an attacker to have access to the target server and to trick a privileged user into viewing malicious content containing conflicting HTML elements.

Impact Analysis

The vulnerability can lead to unauthorized backend interactions or unintended server-side POST requests, which may compromise the integrity and security of the GitHub Enterprise Server instance. This could result in unauthorized actions being performed on behalf of privileged users, potentially leading to data manipulation, leakage, or other security breaches.

Mitigation Strategies

Update GitHub Enterprise Server to version 3.18.3, 3.17.9, 3.16.12, 3.15.16, or 3.14.21 or later, as these versions contain fixes for this vulnerability.

Hi! I’m here to help you understand CVE-2025-14046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70