Stored Cross-Site Scripting in GitHub Enterprise Server

CVE-2026-77912

What is CVE-2026-77912?

A stored cross-site scripting vulnerability was discovered in GitHub Enterprise Server, permitting an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown. This exploit arises due to the Markdown rendering pipeline's failure to properly re-sanitize quote characters in already-sanitized HTML. Maliciously crafted Markdown can leverage same-origin JavaScript capabilities, circumventing Content Security Policy measures to manipulate the DOM of the page when viewed by other users. Successful attacks may allow adversaries to read content visible to the victim, extract CSRF tokens, perform state-changing actions, and exfiltrate data through same-origin writes. Furthermore, the malicious payload can propagate within repositories and organizations where the victim has write permissions. The vulnerability affects supported GitHub Enterprise Server releases, and fixes were issued in specific versions to mitigate the risk.

References