CVE-2025-14046
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-19
Assigner: GitHub, Inc. (Products Only)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| github | enterprise_server | to 3.14.21 (exc) |
| github | enterprise_server | From 3.15.0 (inc) to 3.15.16 (exc) |
| github | enterprise_server | From 3.16.0 (inc) to 3.16.12 (exc) |
| github | enterprise_server | From 3.17.0 (inc) to 3.17.9 (exc) |
| github | enterprise_server | From 3.18.0 (inc) to 3.18.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitHub Enterprise Server involves improper neutralization of user-supplied HTML input, which allows injection of DOM elements with IDs that conflict with server-initialized data islands. These ID collisions can overwrite or shadow important application state objects in certain Project views, potentially causing unintended server-side POST requests or unauthorized backend interactions. Exploitation requires an attacker to have access to the target server and to trick a privileged user into viewing malicious content containing conflicting HTML elements.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized backend interactions or unintended server-side POST requests, which may compromise the integrity and security of the GitHub Enterprise Server instance. This could result in unauthorized actions being performed on behalf of privileged users, potentially leading to data manipulation, leakage, or other security breaches.
What immediate steps should I take to mitigate this vulnerability?
Update GitHub Enterprise Server to version 3.18.3, 3.17.9, 3.16.12, 3.15.16, or 3.14.21 or later, as these versions contain fixes for this vulnerability.