DOM-based Cross-Site Scripting Vulnerability in GitHub Enterprise Server

CVE-2025-11892

What is CVE-2025-11892?

A vulnerability exists in GitHub Enterprise Server that allows for DOM-based cross-site scripting through the Issues search label filter. This could enable an attacker with access to the affected instance to execute malicious scripts, resulting in privilege escalation and unauthorized actions within the workflow. Successful exploitation requires an attacker to lure a user with elevated permissions (operating in sudo mode) to click a specially crafted link, performing actions that should only be accessible through proper authorization. All versions prior to specified secure releases are affected.

References