This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitHub Enterprise Server fixes 4 vulnerabilities

GitHub fixes 4 vulnerabilities in GitHub Enterprise Server with versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3 [1][2][3][4].

GitHub Enterprise Server - RCE (CVE-2026-3854)
CVSS 8.7 (High)

Due to insufficient input validation, an authenticated remote attacker with repository write (push) access can execute code on the instance [1].

The vulnerability is present in product:

  • Github Enterprise Server Versions; <3.14.24; >=3.15.0, <3.15.19; >=3.16.0, <3.16.15; >=3.17.0, <3.17.12; >=3.18.0, <3.18.6; >=3.19.0, <3.19.3

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2026-3854 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 3. 2026.

GitHub Enterprise Server - XSS (CVE-2026-2266)
CVSS 7.4 (High)

Due to insufficient content validation in task lists, an authenticated remote attacker can carry out an XSS attack in another user's browser [2].

The vulnerability is present in product:

  • Github Enterprise Server; <3.18.6; >=3.19.0, <3.19.3

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

More information:

  • CVE-2026-2266 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 3. 2026.

GitHub Enterprise Server - improper authorization (CVE-2026-3306)
CVSS 5.3 (Medium)

An authenticated remote attacker with repository read permissions can bypass the verification process and make unauthorized changes to metadata in issues and pull requests that are part of projects [3].

The vulnerability is present in product:

  • Github Enterprise Server; <3.14.24; >=3.15.0, <3.15.19; >=3.16.0, <3.16.15; >=3.17.0, <3.17.12; >=3.18.0, <3.18.6; >=3.19.0, <3.19.3

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 10. 3. 2026.

GitHub Enterprise Server - improper authorization (CVE-2026-3582)
CVSS 5.3 (Medium)

Because the API ignores configured access token (PAT) restrictions, an authenticated remote attacker can read requests and change history in private repositories without authorization [4].

The vulnerability is present in product:

  • Github Enterprise Server; <3.16.15; >=3.17.0, <3.17.12; >=3.18.0, <3.18.6; >=3.19.0, <3.19.3

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 10. 3. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 17. 3. 2026.

CESNET, z.s.p.o. Logo