CVE-2025-14046 Details
Description
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.
A vulnerability exists in GitHub Enterprise Server prior to versions 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21, allowing improper neutralization of input. This issue enables user-supplied HTML to inject DOM elements that interfere with server-initialized data islands. Such interference can overwrite or obscure critical application state objects in certain Project views, potentially leading to unauthorized server-side POST requests or other backend interactions. Exploitation requires access to the affected GitHub Enterprise Server instance and the ability to entice a privileged user to view the crafted content.
Users can upgrade to GitHub Enterprise Server versions 3.18.3, 3.17.9, 3.16.12, 3.15.16, or 3.14.21. For instructions on upgrading, see the GitHub Enterprise Server upgrade guide.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 11, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github enterprise server | < 3.14.21 >= 3.15.0, < 3.15.16 >= 3.16.0, < 3.16.12 >= 3.17.0, < 3.17.9 >= 3.18.0, < 3.18.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 19, 2025 | Initial Analysis | [email protected] |
| Dec 11, 2025 | New CVE Received | [email protected] |