PT-2026-34210 · Github · Github Enterprise Server

Seokchan Yoon · Published 2026-04-21 · Updated 2026-04-26 · CVE-2026-4821

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description An improper neutralization of special elements allows an authenticated Management Console administrator to execute arbitrary OS commands. This occurs via shell metacharacter injection in proxy configuration fields, such as http proxy. Exploitation requires access to the instance and administrator privileges to the Management Console.

Recommendations Update to versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-4821

Affected Products

Github Enterprise Server

References · 10

• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4821 · Security Note
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8 · Vendor Advisory
• https://twitter.com/_seokchan_yoon/status/2047470957863018652 · Twitter Post
• https://twitter.com/CVEnew/status/2048481085013541127 · Twitter Post