An improper neutralization of special elements vulnerability in GitHub Enterprise Server lets attackers with push access to a repository cause remote code execution by injecting malicious metadata fields during a git push. User‑supplied push option values are not sanitized before being placed into internal service headers. Because the header format uses a delimiter that can appear in the push options, crafted values can introduce additional metadata fields that the server interprets as legitimate. This injection flaw (CWE‑77) can compromise the confidentiality, integrity, and availability of the entire instance. GitHub has released patches starting with GitHub Enterprise Server 3.14.25 and subsequent minor releases, which fix this issue.

GitHub Enterprise Server installations running any version older than 3.14.25 are affected, including all earlier releases such as 3.14.24 and previous minor versions. Any repository that grants push access to a user can be targeted; the attacker only needs push permission on a specific repository, not administrative privileges.

With a CVSS score of 8.7, the vulnerability is considered high severity, and the EPSS score of 36% indicates a relatively high probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Based on the description, the likely attack vector is remote via legitimate git push operations from an external client, requiring an attacker to have push access to the target repository.