CVE-2026-77912

Received Received - Intake

Stored XSS in GitHub Enterprise Server

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc. (Products Only)

Description

A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. Crafted Markdown could abuse same-origin JavaScript gadgets to bypass Content Security Policy and gain control of the page DOM when viewed by another user. Successful exploitation could allow an attacker to read content visible to the victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes. The payload could also propagate to repositories and organizations where the victim had write access. This vulnerability affected supported GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-77912

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	3.17
github	enterprise_server	3.18
github	enterprise_server	3.19
github	enterprise_server	3.20
github	enterprise_server	3.21
github	enterprise_server	3.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GitHub Enterprise Server. An authenticated attacker could inject malicious HTML attributes into Markdown content. The Markdown rendering process rewrote quote characters in sanitized HTML without re-sanitizing, allowing crafted Markdown to bypass Content Security Policy and manipulate the page DOM when viewed by others.

Detection Guidance

This vulnerability is specific to GitHub Enterprise Server and requires checking the installed version against the affected releases (3.17 to 3.22). No direct network or system commands are provided in the context to detect this XSS vulnerability. Review GitHub Enterprise Server logs for unusual Markdown rendering or DOM manipulation events.

Impact Analysis

An attacker could read content visible to victims, steal embedded CSRF tokens, perform actions on behalf of victims, or exfiltrate data through same-origin writes. The payload could spread to repositories and organizations where victims have write access, potentially affecting multiple users.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data access, exfiltration, or state-changing actions through stored XSS. Attackers could read visible content, extract CSRF tokens, or perform actions on behalf of victims, potentially violating data protection requirements for confidentiality and integrity.

Mitigation Strategies

Upgrade GitHub Enterprise Server to the fixed versions: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, or 3.17.21. If immediate upgrade is not possible, restrict access to trusted users and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-77912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70