GitHub vulnerabilities
We track 75 vulnerabilities in GitHub products across 14 products. 75 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest GitHub vulnerabilities
- 7.7 High severity
Enterprise Server: Use After Free
A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalid
- 8.8 High severity
Enterprise Server: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code ex
- 9.8 Critical severity
Enterprise Server: Observable Timing Discrepancy
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to in
- 8.8 High severity
Enterprise Server: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redi
- 7.5 High severity
Enterprise Server: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload reques
- 7.4 High severity
Enterprise Server: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed
- 8.8 High severity
Opensearch: Protection Mechanism Failure
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query end
- 8.1 High severity
OpenSearch: Undefined Behavior for Input to API
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index p
- 8.1 High severity
Opensearch: Server-Side Request Forgery
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel sou
- 7.5 High severity
Enterprise Server: Uncontrolled Recursion
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST reque
- 9.1 Critical severity
Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets
- 7.5 High severity
github-mcp-server: NULL Pointer Dereference
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers
- 8.6 High severity
Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/wor
- 8.2 High severity
Enterprise Server: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting
- 7.8 High severity
copilot-cli: Incorrect Behavior Order
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitr
- 9.8 Critical severity
Enterprise Server: Interpretation Conflict
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library.
- 7.5 High severity
Enterprise Server: Allocation of Resources Without Limits or Throttling
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint pars
- 8.9 High severity
Enterprise Server: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. Whe
- 9.6 Critical severity
Enterprise Server: Authorization Bypass Through User-Controlled Key
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations,
- 8.8 High severity
Enterprise Server: Incorrect Regular Expression
An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a mal
- 8.8 High severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push
- 7.8 High severity
copilot-cli: Improper Neutralization of Special Elements used in an OS Command
The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection
- 9.0 Critical severity
Enterprise Server: URL Redirection to Untrusted Site
An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs, preserving t
- 9.6 Critical severity
Enterprise Server: Improper Neutralization of Input During Web Page Generation
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploi
- 7.2 High severity
Enterprise Server: Improper Link Resolution Before File Access
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious rep
- 7.2 High severity
Enterprise Server: Improper Control of Generation of Code
A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vul
- 7.6 High severity
GitHub Enterprise Server: Improper Neutralization of Input During Web Page Generation
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and p
- 7.1 High severity
Enterprise Server: Improper Control of Generation of Code
A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by man
- 7.1 High severity
codeql-action: Insertion of Sensitive Information into Log File
In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users
- 8.8 High severity
Enterprise Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an ex
- 7.5 High severity
go-gh: Exposure of Sensitive Information to an Unauthorized Actor
go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codes
- 9.6 Critical severity
cli: Improper Neutralization of Special Elements used in a Command
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote code
- 9.1 Critical severity
Enterprise Server: Improper Link Resolution Before File Access
A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administrator access to the G
- 9.1 Critical severity
Enterprise Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required t
- 7.5 High severity
toolkit: Improper Limitation of a Pathname to a Restricted Directory
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExterna
- 9.8 Critical severity
GitHub Enterprise Server: Improper Verification of Cryptographic Signature
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct
- 7.2 High severity
GitHub Enterprise Server: Server-Side Request Forgery
A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authent
- 9.8 Critical severity
Enterprise Server: Incorrect Implementation of Authentication Algorithm
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provi
- 7.2 High severity
Enterprise Server: Improper Neutralization of Argument Delimiters in a Command
A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Ex
- 7.2 High severity
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an…
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerabili