GitHub Enterprise Server CVE-2026-77912

Requires an authenticated account on the target GitHub Enterprise Server instance (PR:L) able to submit Markdown content, and a second victim user who views the rendered malicious content (UI:P/UI:R). Exploitation is not trivial: the attacker must craft a payload that both survives initial HTML sanitization and is transformed by the Markdown pipeline's quote-character rewriting into injectable attributes, then chain same-origin JavaScript gadgets to defeat the Content Security Policy (reflected in AC:H). It affects GHES releases in the 3.17 through 3.22 series; instances patched to 3.22.1/3.21.6/3.20.8/3.19.12/3.18.15/3.17.21 or later are not vulnerable. Impact escalates where the victim has write access, allowing the payload to propagate to their repositories and organizations.

This is a genuine but moderate-priority stored XSS in GitHub Enterprise Server (GHES). The vendor CVSS 4.0 vector (7.4) is internally consistent with the description: AV:N (web-based), PR:L (authenticated attacker required), UI:P (victim must view the crafted content), AC:H (exploitation depends on chaining same-origin JavaScript gadgets to bypass Content Security Policy - a non-trivial condition, not a simple script injection), and VC:H/VI:H reflecting full DOM control and CSRF-token theft enabling state-changing actions as the victim. SC:L/SI:L capture cross-user/cross-repo propagation. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization. The report originates from the GitHub Bug Bounty program (GitHub_P) with fixes already shipped across all supported branches, indicating responsible disclosure rather than in-the-wild abuse. The AC:H (CSP-bypass gadget dependency) plus PR:L and UI:P requirements materially lower real-world exploitability versus a raw unauthenticated XSS. No signals conflict; the main gap is the absence of EPSS/KEV/POC telemetry, which is expected for a freshly-patched bug-bounty finding.

An authenticated user on a GHES instance crafts Markdown (e.g., in an issue, PR, comment, or README) that survives HTML sanitization but is mutated by the pipeline's quote-character rewriting into injectable HTML attributes. When a colleague or maintainer views the rendered content, same-origin JavaScript gadgets fire, bypass CSP, and take control of the victim's page DOM - reading visible content, stealing embedded CSRF tokens, and performing actions as the victim. No public exploit code was identified at time of analysis.