The vulnerability is a server‑side request forgery in the notebook viewer of GitHub Enterprise Server. When a user supplies a URL, the viewer checks the scheme and host but ignores the port, allowing internal services on other ports of the same appliance to be accessed. The response body is not returned, but response timing can be used as an oracle to extract instance secrets one character at a time. Once a secret is recovered, it can be used in a separate interaction with an internal service to achieve remote code execution on the appliance.

Affected products are GitHub Enterprise Server, specifically the notebook viewer component, for versions 3.17 through 3.22 inclusive. The issue was addressed in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. Administrators should verify that their instance is running a patched version.

The risk is high, reflected in a CVSS score of 9.3. Exploitation requires network access to the instance; if private mode is disabled it is unauthenticated, otherwise any authenticated user can exploit it. Because the attacker can learn secrets via timing, they can then leverage those secrets to reach internal services and achieve remote code execution. The EPSS score is not available, and the vulnerability is not listed in KEV, but the high severity and potential for full system compromise warrant urgent attention.