An improper neutralization of special elements vulnerability in GitHub Enterprise Server lets attackers with push access to a repository cause remote code execution by injecting malicious metadata fields during a git push. User‑supplied push option values are not sanitized before being placed into internal service headers. Because the header format uses a delimiter that can appear in the push options, crafted values can introduce additional metadata fields that the server interprets as legitimate. This injection flaw (CWE‑77) can compromise the confidentiality, integrity, and availability of the entire instance. GitHub has released patches starting with GitHub Enterprise Server 3.14.25 and subsequent minor releases, which fix this issue.

GitHub Enterprise Server installations running any version older than 3.14.25 are affected, including all earlier releases such as 3.14.24 and previous minor versions. Any repository that grants push access to a user can be targeted; the attacker only needs push permission on a specific repository, not administrative privileges.

With a CVSS score of 8.7, the vulnerability is considered high severity, but the EPSS score is below 1%, indicating that exploit attempts are rare at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector is likely local to the server through legitimate git push operations, and an attacker must have push access to the target repository to exploit the flaw.