Executive brief
GitHub Enterprise Server is a self-hosted platform for software development and version control. A vulnerability in the Management Console allowed administrators to execute unauthorized operating system commands by entering malicious characters into proxy configuration settings. While this requires administrative access, an exploit could allow a user to gain full control over the underlying server hosting the GitHub instance.
Technical details
An improper neutralization of special elements (CWE-78) vulnerability exists in GitHub Enterprise Server's Management Console. An authenticated administrator could achieve arbitrary OS command execution via shell metacharacter injection within proxy configuration fields, such as http_proxy. The attack vector is network-based but requires high privileges (Management Console administrator). Although the CVE was later marked as 'Rejected' due to being published in error, the technical details describe a fixed vulnerability affecting versions prior to 3.21, with specific patches available in the 3.14 through 3.20 release series.
Affected products
- GitHub Enterprise Server < 3.21 (specifically fixed in 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26)
Timeline
- 2026-04-21: disclosed
- 2026-06-10: other: CVE marked as Rejected/Withdrawn by CNA