PT-2026-24374 · Github · Github Enterprise Server

Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-2266

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.20 GitHub Enterprise Server versions 3.18.6 and 3.19.3

Description An improper neutralization of input issue exists in GitHub Enterprise Server, allowing DOM-based cross-site scripting via task list content. The task list content extraction logic did not properly re-encode browser-decoded text nodes before rendering, enabling user-supplied HTML to be injected into the page. An authenticated attacker could create malicious task list items in issues or pull requests to execute arbitrary scripts in the context of another user’s browser session. The vulnerability involves the improper handling of input during task list content extraction. The vulnerable component allows the injection of HTML through crafted task list items.

Recommendations Update to GitHub Enterprise Server version 3.18.6. Update to GitHub Enterprise Server version 3.19.3. Update to GitHub Enterprise Server version 3.20 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2266

Affected Products

Github Enterprise Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2266 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2266 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031504154011615319 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031505867346940273 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3 · Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6 · Note