Github · Github Enterprise Server · CVE-2026-4821
**Name of the Vulnerable Software and Affected Versions**
GitHub Enterprise Server versions prior to 3.21
**Description**
An improper neutralization of special elements allows an authenticated Management Console administrator to execute arbitrary OS commands. This occurs via shell metacharacter injection in proxy configuration fields, such as `http proxy`. Exploitation requires access to the instance and administrator privileges to the Management Console.
**Recommendations**
Update to versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.