Cross-Site Scripting Vulnerability in GitHub Enterprise Server

CVE-2025-3246

What is CVE-2025-3246?

A vulnerability was identified in GitHub Enterprise Server that allows for cross-site scripting attacks through improperly neutralized input. Specifically, this issue pertains to the use of $$..$$ math blocks in GitHub Markdown. Attackers with access to the server may exploit this vulnerability to execute malicious scripts, but it requires privileged user interaction for exploitation. The vulnerability has been resolved in version 3.16.2 following a report through the GitHub Bug Bounty program.

References