Which versions of GitHub Enterprise Server are affected by EUVD-2026-24547?

GitHub Enterprise Server prior to version 3.21 contains an OS command injection vulnerability in the Management Console that permits authenticated administrators to execute arbitrary shell commands…. A patch is available.

How to fix or mitigate EUVD-2026-24547?

Within 24 hours, audit your environment to identify all GitHub Enterprise Server instances and document their current versions. Within 7 days, design and validate an upgrade path to version 3.21 or later in your non-production test environment to ensure compatibility with existing deployments. Within 30 days, execute the patched version deployment, beginning with non-critical systems before rolling out to production instances.

GitHub Enterprise Server EUVD-2026-24547

Q: What is the CVSS score of EUVD-2026-24547?

EUVD-2026-24547 has a CVSS 4.0 base score of 8.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4821 HIGH

OS Command Injection (CWE-78)

2026-04-21 product-cna@github.com

GHSA-6hg9-m8fv-wq83

Command Injection Enterprise Server

8.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Requires local Management Console admin access (AV:L, PR:H) with no user interaction, but shell command injection yields full OS compromise, so C/I/A are all High - broader than the vendor's integrity-only rating.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:22 vuln.today

Patch released

Apr 29, 2026 - 12:36 nvd

Patch available

Apr 22, 2026 - 02:01 EUVD

EUVD ID Assigned

Apr 21, 2026 - 23:22 euvd

EUVD-2026-24547

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

OS command injection in GitHub Enterprise Server (all releases prior to 3.21) lets an authenticated Management Console administrator run arbitrary shell commands on the underlying appliance by embedding shell metacharacters in proxy configuration fields such as http_proxy. The flaw was reported through the GitHub Bug Bounty program and there is no public exploit identified at time of analysis; EPSS is negligible (0.01%, 3rd percentile) and CISA SSVC rates exploitation as none. Because it requires high-privilege console access, it is primarily a privilege-boundary escape from Management Console admin to full OS-level control rather than a remotely reachable pre-auth issue.

Technical ContextAI

GitHub Enterprise Server is the self-hosted, on-premises appliance version of GitHub, administered in part through a web-based Management Console that stores instance settings including outbound proxy parameters (http_proxy, and similarly HTTPS/no_proxy style fields). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied proxy values are passed into a shell context without adequate sanitization, so metacharacters (e.g. ;, |, $(), backticks) break out of the intended argument and are interpreted as commands. The affected CPE is cpe:2.3:a:github:enterprise_server across the vulnerable version lines, with 3.20.0 explicitly enumerated. This is a classic configuration-field-to-shell injection pattern where an administrative input that appears to be a simple string is consumed by a system-level command invocation.

RemediationAI

Vendor-released patches are available: upgrade GitHub Enterprise Server to 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or the fixed 3.14 line release (description states 3.14.26; the linked release note references 3.14.24 - confirm with the vendor), matching your deployed release line, using the release notes at https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 and the equivalent per-version pages. If immediate patching is not possible, the practical compensating control is to tightly restrict who holds Management Console administrator credentials and network access to the console: enforce strong, unique console passwords, place the Management Console behind an admin-only network segment or VPN/allowlist so it is not broadly reachable, and enable auditing/alerting on any change to proxy settings - the trade-off is added operational friction for legitimate admins and no protection against a malicious or compromised console admin, so this is a stopgap only. Avoid editing proxy configuration fields with untrusted values until patched.