Improper Neutralization Vulnerability in GitHub Enterprise Server

CVE-2026-4821

What is CVE-2026-4821?

An improper neutralization of special elements vulnerability exists within GitHub Enterprise Server, allowing authenticated Management Console administrators to execute arbitrary operating system commands. This risk arises from shell metacharacter injection in proxy configuration fields, such as http_proxy. Successful exploitation mandates both access to the GitHub Enterprise Server instance and administrator privileges in the Management Console. The vulnerability impacts all GitHub Enterprise Server versions prior to 3.21 and has been addressed in recent updates.

References