An improper neutralization of special elements vulnerability in GitHub Enterprise Server lets attackers with push access to a repository cause remote code execution by injecting malicious metadata fields during a git push. User‑supplied push option values are not sanitized before being placed into internal service headers. Because the header format uses a delimiter that can appear in the push options, crafted values can introduce additional metadata fields that the server interprets as legitimate. This injection flaw (CWE‑77) can compromise the confidentiality, integrity, and availability of the entire instance. GitHub has released patches starting with GitHub Enterprise Server 3.14.25 and subsequent minor releases, which fix this issue.

GitHub Enterprise Server installations running any version older than 3.14.25 are affected, including all earlier releases such as 3.14.24 and previous minor versions. Any repository that grants push access to a user can be targeted; the attacker only needs push permission on a specific repository, not administrative privileges.

With a CVSS score of 8.7, the vulnerability is considered high severity, but the EPSS score is 10%, indicating that exploit attempts are more common. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Based on the description, the likely attack vector is local via legitimate git push operations, requiring an attacker to have push access to the target repository.