PT-2025-17245 · Github · Github Enterprise Server

CVE-2025-3246 · Published 2025-04-17 · Updated 2025-10-01

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server version 3.16.1

Description An improper neutralization of input issue was identified in GitHub Enterprise Server, allowing cross-site scripting in GitHub Markdown that used $$..$$ math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user interaction with the malicious elements.

Recommendations For version 3.16.1, update to version 3.16.2 to resolve the issue. As a temporary workaround, consider restricting the use of $$..$$ math blocks in GitHub Markdown until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-05159

CVE-2025-3246

Affected Products

Github Enterprise Server

References · 13

• https://osv.dev/vulnerability/CVE-2025-3246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3246 · Security Note
• https://bdu.fstec.ru/vul/2025-05159 · Security Note
• https://twitter.com/CVEnew/status/1913091266817958228 · Twitter Post
• https://twitter.com/OSINTAFRICA89/status/1973396636656193798 · Twitter Post
• https://twitter.com/cybercronai/status/1913310545215672737 · Twitter Post
• https://twitter.com/threatsbank/status/1913201620944384121 · Twitter Post
• https://t.me/cvedetector/23291 · Telegram Post
• https://t.me/cveNotify/134405 · Telegram Post
• https://t.me/cvetracker/21903 · Telegram Post
• https://twitter.com/fletch_ai/status/1914590049385185606 · Twitter Post
• https://reddit.com/r/GitProtect/comments/1k56gl1/github_patches_vulnerabilities_in_its_enterprise · Reddit Post
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2 · Note