Improper Input Neutralization in GitHub Enterprise Server

CVE-2025-14046

What is CVE-2025-14046?

An improper neutralization of input vulnerability exists in GitHub Enterprise Server that permits the injection of user-supplied HTML. This can lead to ID collisions with server-initialized data islands, potentially enabling the overwriting or shadowing of important application state objects in certain Project views. As a result, this may lead to unintended server-side POST requests or unauthorized backend interactions. To exploit this vulnerability, an attacker must gain access to the GitHub Enterprise Server instance and convince a privileged user to view maliciously crafted content that includes conflicting HTML elements.

References