CVE-2025-14046
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-19

Assigner: GitHub, Inc. (Products Only)

Description
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-11
Last Modified
2025-12-19
Generated
2026-06-16
AI Q&A
2025-12-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14046
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
github enterprise_server to 3.14.21 (exc)
github enterprise_server From 3.15.0 (inc) to 3.15.16 (exc)
github enterprise_server From 3.16.0 (inc) to 3.16.12 (exc)
github enterprise_server From 3.17.0 (inc) to 3.17.9 (exc)
github enterprise_server From 3.18.0 (inc) to 3.18.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in GitHub Enterprise Server involves improper neutralization of user-supplied HTML input, which allows injection of DOM elements with IDs that conflict with server-initialized data islands. These ID collisions can overwrite or shadow important application state objects in certain Project views, potentially causing unintended server-side POST requests or unauthorized backend interactions. Exploitation requires an attacker to have access to the target server and to trick a privileged user into viewing malicious content containing conflicting HTML elements.

Impact Analysis

The vulnerability can lead to unauthorized backend interactions or unintended server-side POST requests, which may compromise the integrity and security of the GitHub Enterprise Server instance. This could result in unauthorized actions being performed on behalf of privileged users, potentially leading to data manipulation, leakage, or other security breaches.

Mitigation Strategies

Update GitHub Enterprise Server to version 3.18.3, 3.17.9, 3.16.12, 3.15.16, or 3.14.21 or later, as these versions contain fixes for this vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart