GitHub Enterprise Server EUVD-2026-40424

Q: What is the CVSS score of EUVD-2026-40424?

EUVD-2026-40424 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-10585 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 product-cna@github.com

GHSA-f24q-32qp-rrx8

XSS Enterprise Server

6.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Network-delivered stored XSS requires an authenticated account (PR:L) and victim page view (UI:R); scope changes because full JavaScript execution in the victim's browser enables session hijacking (C:H/I:H on subsequent system).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 22:31 vuln.today

DescriptionCVE.org

A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's browser by injecting a crafted payload into the title of a Discussion in the Q&A category. The AnsweredQuestionStructuredDataComponent did not escape user-controlled Discussion titles before embedding them in a <script type="application/ld+json"> block, allowing the title to break out of the script context. The injection was escalated to a full cross-site scripting attack on GitHub Enterprise Server by leveraging JSONP callback support in the REST API to bypass the Content Security Policy. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17. This vulnerability was reported via the GitHub Bug Bounty program https://bounty.github.com/ .

AnalysisAI

Stored cross-site scripting in GitHub Enterprise Server's Q&A Discussion feature allows an authenticated attacker to execute arbitrary JavaScript in any visiting user's browser by embedding a crafted payload into a Discussion title. The AnsweredQuestionStructuredDataComponent unsafely injects user-controlled titles into a server-rendered <script type="application/ld+json"> block, enabling script-context breakout; the attacker then leverages JSONP callback support in the GHES REST API to load arbitrary JavaScript and bypass the Content Security Policy entirely. No public exploit or CISA KEV listing exists at time of analysis, but the CSP bypass mechanism substantially elevates practical impact beyond typical stored XSS, enabling full session hijacking of any user who views the malicious Discussion.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically within the AnsweredQuestionStructuredDataComponent, a server-side rendering component responsible for embedding JSON-LD structured data into Discussion pages in the Q&A category. JSON-LD blocks are rendered inside a <script type="application/ld+json"> tag, which browsers treat as data - not executable JavaScript - unless the content breaks out of the JSON string boundary. Because Discussion titles were not HTML-entity-encoded or JSON-escaped before insertion, an attacker could inject characters such as </script><script> or malformed JSON to terminate the data block and introduce executable code. The second, more sophisticated layer is the CSP bypass: GitHub Enterprise Server's REST API includes JSONP callback endpoints - a legacy mechanism allowing callers to specify an arbitrary JavaScript function name as a query parameter, causing the server to wrap its response in that function call. Since these responses are served from the same origin as the application, the browser's Content Security Policy permits loading them as scripts, allowing the attacker to craft a JSONP URL whose callback parameter contains executable JavaScript, effectively circumventing the CSP that would otherwise block injected inline scripts. Affected CPE covers all GHES deployments prior to version 3.21.

RemediationAI

Upgrade GitHub Enterprise Server to the patched release corresponding to the deployed branch: 3.17.17, 3.18.11, 3.19.8, or 3.20.4, per the vendor release notes linked above. These are vendor-confirmed fixes per the GitHub CNA disclosure. If an immediate upgrade is not operationally feasible, a targeted compensating control is to restrict Discussion creation in the Q&A category to a trusted subset of users (e.g., organization owners or designated maintainers only), which reduces the attacker population to those with elevated trust; note this will impact developer self-service workflows. Disabling the Q&A Discussion category entirely for repositories where it is not in active use is a higher-impact control with minimal functional cost. Additionally, GHES administrators should audit whether JSONP callback endpoints in the REST API can be disabled or restricted at the network or application layer, as this independently removes the CSP bypass vector even without the application-level patch - however, JSONP disablement may break legacy integrations or scripts that rely on it. Do not rely on CSP alone as a mitigation; the exploit specifically demonstrates a method to circumvent it.