GitHub Enterprise Server CVE-2025-14046

Exploitation requires: (1) the attacker to have access to the target GitHub Enterprise Server instance (per the description, implying a valid account to post crafted content, despite the CVSS vector's PR:N); (2) the ability to submit HTML containing element IDs that collide with server-initialized data islands rendered in certain Project views; and (3) a privileged user to actively view that crafted malicious content (UI:P). Limiting factors: the required privileged-victim interaction and the need for prior instance access significantly constrain exploitation versus a true unauthenticated remote attack; the flaw specifically targets 'certain Project views,' so impact depends on the victim navigating to an affected view. Instances are not affected if patched to 3.18.3 / 3.17.9 / 3.16.12 / 3.15.16 / 3.14.21 or later.

This is a credible but not emergency-tier issue. The vendor (GitHub, acting as CNA) assigns CVSS 4.0 8.6 (High) via CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P with high confidentiality and integrity impact (VC:H/VI:H), which reads as network-reachable, low-complexity, no-privileges, requiring passive user interaction. However, the CVSS vector and the description conflict on privileges: the vector encodes PR:N (unauthenticated) while the description explicitly states 'Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance,' which implies at least a valid account on the instance - verify intended privilege level with the vendor, as PR:N likely undercounts the real barrier. Exploitation additionally requires enticing a PRIVILEGED user to view attacker-crafted content (UI:P), a meaningful social-engineering dependency that lowers real-world likelihood. EPSS is 0.39% (30th percentile) - low - which is consistent with a DOM-clobbering/XSS-class flaw that needs victim interaction and is not trivially automatable; this is NOT in CISA KEV and there is no public exploit identified at time of analysis. Net: a real priority to patch on GitHub Enterprise Server instances (especially multi-tenant/large-user-base deployments) because the impact on a privileged account is high, but the UI and instance-access prerequisites make mass, widespread exploitation unlikely rather than imminent.

An attacker with an account on a GitHub Enterprise Server instance crafts content (e.g., in a Project or issue) containing HTML whose element IDs collide with server-initialized JavaScript data islands, then lures a privileged user (such as an org/admin) into viewing it. When the victim's browser renders the page, the clobbered DOM shadows application-state objects used by Project views, causing the victim's session to issue unintended POST requests or unauthorized backend interactions. No public exploit code has been identified at time of analysis, so an attacker would need to develop the clobbering payload themselves.