This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitHub Enterprise Server fixes 2 vulnerabilities

GitHub fixes 2 vulnerabilities in GitHub Enterprise Server in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20 [1][2].

GitHub Enterprise Server - XSS (CVE-2026-10585)
CVSS 6.3 (Medium)

Allows an authenticated remote attacker to carry out a stored XSS attack in the title of a discussion in the Q&A category [1].

The vulnerability is present in product:

  • GitHub Enterprise Server; >=3.21.0, <3.21.2; >=3.20.0, <3.20.4; >=3.19.0, <3.19.8; >=3.18.0, <3.18.11; >=3.17.0, <3.17.17; >=3.16.0, <3.16.20;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

More information:

  • CVE-2026-10585 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 1. 7. 2026.

GitHub Enterprise Server - incorrect access check (CVE-2026-14340)
CVSS 5.3 (Medium)

Allows an authenticated remote attacker with an access token bound to a GitHub App installation to create content (such as "issues" and "comments") without authorization in arbitrary public repositories outside the scope of the token's permitted access [2].

The vulnerability is present in product:

  • GitHub Enterprise Server; >=3.21.0, <3.21.2; >=3.20.0, <3.20.4; >=3.19.0, <3.19.8; >=3.18.0, <3.18.11; >=3.17.0, <3.17.17; >=3.16.0, <3.16.20;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 1. 7. 2026.

By CESNET, z.s.p.o. Martin Krajči on 2. 7. 2026.

CESNET, z.s.p.o. Logo