GitHub vulnerabilities
We track 75 vulnerabilities in GitHub products across 14 products. 75 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest GitHub vulnerabilities
- 7.2 High severity
Enterprise Server: Improper Privilege Management
An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for a
- 7.2 High severity
An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access…
An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.
- 7.2 High severity
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an…
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring SMTP options. Exploitation of thi
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring audit log forwarding. Exploitatio
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring SAML settings. Exploitation of this vulnerability req
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collectd configurations. Ex
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting up an HTTP proxy. Exploitation of this vulnerability requ
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL.
- 8.0 High severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the `syslog-ng` configuration file. Exploitation of this vulnerabi
- 8.8 High severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed
- 9.8 Critical severity
Enterprise Server: Use of Externally-Controlled Input to Select Classes or Code
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need
- 9.8 Critical severity
Cmark-gfm: Integer Overflow or Wraparound
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execut
- 7.5 High severity
Enterprise Server: Improper Authentication
An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API request. To exploit this vulnerability, an attacker would need network access to the Enterprise Server ap
- 7.0 High severity
Enterprise Server: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 an
- 7.5 High severity
Enterprise Server: Insufficient Entropy
An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invita
- 8.8 High severity
Enterprise Server: Improper Privilege Management
Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. Thi
- 7.1 High severity
Enterprise Server: Incorrect Comparison
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerabilit
- 7.5 High severity
cmark-gfm: Uncontrolled Resource Consumption
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of ser
- 7.5 High severity
cmark-gfm: Uncontrolled Resource Consumption
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity i
- 7.5 High severity
cmark-gfm: Uncontrolled Resource Consumption
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity i
- 8.8 High severity
Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitH
- 8.8 High severity
Enterprise Server: Improper Control of Generation of Code
A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. To exploit this vulnerability, an attac
- 7.5 High severity
cmark-gfm: Uncontrolled Resource Consumption
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent de
- 7.5 High severity
cmark-gfm: Inefficient Algorithmic Complexity
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial
- 7.5 High severity
cmark-gfm: Inefficient Algorithmic Complexity
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent
- 9.8 Critical severity
GitHub Enterprise Server: Incorrect Authorization
An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify mos
- 7.2 High severity
GitHub Enterprise Server: Incorrect Authorization
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App.
- 8.8 High severity
GitHub Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the inst
- 9.8 Critical severity
GitHub Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A check was added within Pages to ensure the working directory is clean before unpacking new content to
- 8.8 High severity
GitHub Enterprise Server: Improper Neutralization of Argument Delimiters in a Command
CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pa
- 8.8 High severity
GitHub Enterprise Server: Deserialization of Untrusted Data
A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request f
- 7.5 High severity
trilogy: Use of Uninitialized Resource
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the tri
- 8.8 High severity
GitHub Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a use
- 9.8 Critical severity
cmark-gfm: Integer Overflow or Wraparound
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when par