An authentication‑bound flaw in the task list content extraction logic of GitHub Enterprise Server allows malicious content to be injected into the page. The vulnerable code fails to re‑encode browser‑decoded text nodes, permitting a user to place arbitrary HTML in an issue or pull request task. When rendered, the browser executes any embedded script in the context of the victim’s session, giving the attacker the capability to steal credentials, deface content or perform other malicious actions. The root weakness is improper input validation (CWE‑79).

GitHub Enterprise Server is affected across all releases preceding 3.20. The rapid release cycle issued fixes in version 3.18.6 and in 3.19.3. Any instance running 3.18.0‑3.18.5, 3.19.0‑3.19.2, or earlier 3.17.x and older is vulnerable. The issue was addressed by patching the extraction logic to properly neutralize input before rendering.

With a CVSS score of 7.4, this vulnerability poses a high severity risk, yet its EPSS score is below 1 %, indicating a low yet non‑zero likelihood of exploitation. The vulnerability is not listed in the KEV catalog. An authenticated attacker can craft a malicious task list that, when viewed by another user, triggers arbitrary script execution. The primary attack vector is through the web interface where valid users add or edit content; therefore, environments with many authenticated users and open issue discussion are at higher risk. Prompt patching mitigates the risk entirely.