VulnSocial

CVE-2026-77912Disclosure(github / enterprise_server)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch github enterprise_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. Crafted Markdown could abuse same-origin JavaScript gadgets to bypass Content Security Policy and gain control of the page DOM when viewed by another user. Successful exploitation could allow an attacker to read content visible to the victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes. The payload could also propagate to repositories and organizations where the victim had write access. This vulnerability affected supported GitHub Enterprise Server releases in the 3.17, 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported via the GitHub Bug Bounty program.

github CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_server

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
github
Products
enterprise_server

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-09-24: 1Patch / Workaround · 2026-09-24: 1Technical Details · 2026-09-22: 1Technical Details · 2026-09-24: 109-2209-24
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-221
Disclosure1
2026-09-241
Patch1
Full discourse2 posts
  • Dark Web Intelligence@DailyDarkWeb
    Patch

    🚨 GITHUB ENTERPRISE SERVER CRITICAL: NOTEBOOK VIEWER SSRF TO RCE (CVE-2026-77987) GitHub released Enterprise Server 3.22.1 (and matching fixes on 3.21–3.17) on September 22, 2026 with a Critical security fix. Lead Critical issue (CVSS 9.3): * CVE-2026-77987 — notebook viewer SSRF: scheme/host were validated but an explicit port was not, so an attacker with network access could reach co-located internal services. Response timing acted as an oracle to extract instance secrets, which could then be used to obtain remote code execution on the appliance. Unauthenticated when private mode is disabled; any authenticated user when private mode is enabled. Also in the same release: High stored XSS via crafted Markdown HTML attribute injection (CVE-2026-77912), plus additional Packages upload-auth and stafftools token hardening. Fixed in: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, 3.17.21. Self-managed GHES admins should upgrade promptly. ⚠️ Analyst Note: This is an official GitHub Enterprise Server Critical release-note fix, not a dark-web leak claim and not a CISA KEV add as of our check. No confirmed in-the-wild exploitation is claimed in the vendor notes reviewed here (CISA-ADP SSVC: Exploitation none). Credit: Seokchan Yoon (R31n) via GitHub Bug Bounty. Primary: https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.1 #DDW #DarkWeb #GitHub #GHES #CVE202677987 #SSRF #RCE #ThreatIntelligence #CyberSecurity

    Post summary

    The announcement details a critical CVSS 9.3 SSRF-to-RCE vulnerability in GitHub Enterprise Server, provides specific patched versions, and advises immediate upgrades, with no evidence of active exploitation.

    1202367.3K
    209.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-77912 A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attribute… https://www.cve.org/CVERecord?id=CVE-2026-77912

    Post summary

    The text discloses a stored XSS vulnerability in GitHub Enterprise Server affecting authenticated attackers' ability to inject arbitrary HTML attribute content. It provides no PoC, exploit code, active exploitation claim, or remediation guidance.

    000101.5K
    58.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgithubenterprise_server---

Explore more

Back to dashboardgithub CVEsenterprise_server vulnerabilities