A stored cross‑site scripting vulnerability (CWE‑79) in GitHub Enterprise Server allows an authenticated attacker to inject a crafted payload into the title of a Discussion in the Q&A category, causing arbitrary JavaScript to execute in any victim’s browser that views the Discussion. The vulnerability originates from the AnsweredQuestionStructuredDataComponent, which fails to escape user‑controlled titles before including them in a <script type=\"application/ld+json\"> block, enabling the payload to break out of the JSON context. The attacker then leverages JSONP callback support in the REST API to bypass the Content Security Policy, allowing the stored payload to execute as full cross‑site scripting.

GitHub Enterprise Server versions released before 3.21 are vulnerable; the flaw was fixed in the 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20 patch releases. Upgrading to one of these patched releases removes the vulnerability.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with rights to create or edit Discussion titles; once the malicious title is stored it will be rendered in the browsers of any user who views the Discussion or queries the API. Because the attack surface is limited to privileged users, the overall risk is moderate but still warrants rapid remediation.