The vulnerability exists in the GitHub Enterprise Server notebook viewer, where the hostname validation uses a different URL parser than the HTTP request library. This mismatch allows a crafted URL to pass validation while directing the server to an unintended internal host, resulting in a server‑side request forgery. An attacker can cause the instance to fetch data from any internal endpoint, potentially exfiltrating sensitive information and compromising confidentiality.

GitHub Enterprise Server releases prior to 3.21 are affected. All versions up to 3.20, including 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2, have been patched. Any GitHub Enterprise Server installation running those earlier versions is considered exposed.

The CVSS base score of 7.9 signals a high‑severity SSRF that can allow attackers to access internal resources. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, indicating no widely reported exploitation. Exploitation requires network access to the GitHub Enterprise Server instance and use of the notebook viewer feature. Once the attacker submits a crafted URL, the server can reach arbitrary internal hosts, enabling unauthorized data access.