GitHub Enterprise Server EUVD-2026-40424

Exploitation requires the attacker to hold a valid authenticated account on the target GitHub Enterprise Server instance with permission to create Discussions in the Q&A category (PR:L). The victim must navigate to the Discussion page where the malicious title is rendered - passive browsing of the Discussions tab is sufficient, no explicit file download or link-click beyond normal page navigation is required (UI:P). The CSP bypass leg of the attack requires that JSONP callback endpoints on the GHES REST API are reachable from the victim's browser, which is the default configuration. Exploitation is meaningfully limited by: the authentication requirement (an unauthenticated external attacker cannot create Discussions), the victim interaction step (the victim must view the specific Discussion page), and the Q&A category specificity (only Discussions in the Q&A category render the AnsweredQuestionStructuredDataComponent affected by this flaw - Discussions in other categories are not affected by this specific code path). There is no requirement for a privileged account, administrative access, special network position, or non-default GHES configuration beyond standard Discussion access.

The CVSS 4.0 score of 6.3 (Medium) accurately captures the multi-signal risk profile: AV:N and AC:L confirm the attack is network-accessible with low complexity, while PR:L reflects the authentication requirement and UI:P the need for victim interaction. The most telling signals are SC:H and SI:H - the subsequent-system impact metrics - which reflect that the true damage falls on the victim user's browser session, not the attacker's own data (VC:L/VI:L). In practice, the CSP bypass via JSONP elevates this well beyond a self-contained nuisance: a successfully executed payload can exfiltrate session tokens, impersonate the victim, enumerate private repositories, or plant persistent backdoors in code. The UI:P (passive interaction - victim merely browses to the Discussion) is a low bar in a developer collaboration environment where viewing Discussions is routine behavior. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively stated. There is no CISA KEV listing and no public exploit code identified at time of analysis, meaning exploitation is not confirmed as widespread. However, the CSP bypass technique is well-documented in the security community and the attack primitive (crafted Discussion title) is trivially constructed by any authenticated user. Organizations running GHES with open Discussion access should treat patching as a genuine priority rather than a deferred maintenance item.

An authenticated GHES user creates a new Q&A Discussion and sets the title to a crafted string that terminates the JSON-LD script block and injects a JSONP-backed script tag pointing to a REST API endpoint with an attacker-controlled callback parameter. When a victim developer navigates to the Discussion page - for example, while triaging questions from colleagues - the injected script fires in the victim's browser, extracting the session cookie or CSRF token and transmitting it to an attacker-controlled endpoint, enabling full account takeover without any further interaction. No public exploit code is known at time of analysis, but the technique requires only standard browser developer tools to construct.