Improper Input Neutralization in GitHub Enterprise Server

CVE-2025-13744

What is CVE-2025-13744?

A vulnerability was identified in GitHub Enterprise Server involving improper neutralization of user input during web page generation. This flaw allowed an attacker, with the necessary permissions to create or modify names of milestones, issues, or pull requests, to manipulate HTML rendering within the Filter component of the search functionality. This could potentially allow unauthorized access to sensitive information by exfiltrating data through crafted inputs. All versions of GitHub Enterprise Server prior to version 3.20 are affected, with multiple fixed versions available, ensuring strengthened security against this type of attack.

References