CVE-2025-14046: GitHub Enterprise Server XSS Vulnerability

CVE-2025-14046 Overview

CVE-2025-14046 is an improper neutralization of input vulnerability [CWE-79] in GitHub Enterprise Server. The flaw allows user-supplied HTML to inject DOM elements whose id attributes collide with server-initialized data islands. These collisions overwrite or shadow application state objects used by certain Project views. An attacker who can post crafted content on a target GitHub Enterprise Server instance can trigger unintended server-side POST requests or unauthorized backend interactions when a privileged user views the malicious content.

Critical Impact
Successful exploitation requires a privileged user to view attacker-crafted content, which can then coerce their browser into issuing authenticated backend requests against the GitHub Enterprise Server instance.

Affected Products

GitHub Enterprise Server versions prior to 3.18.3
GitHub Enterprise Server versions prior to 3.17.9, 3.16.12
GitHub Enterprise Server versions prior to 3.15.16 and 3.14.21

Discovery Timeline

2025-12-11 - CVE-2025-14046 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14046

Vulnerability Analysis

The vulnerability is a DOM clobbering issue in the GitHub Enterprise Server web interface. Server-rendered pages embed data islands identified by fixed DOM id values. Client-side JavaScript reads these elements to initialize application state for Project views. Because user-supplied HTML is not fully neutralized, attackers can inject elements that share those id values. The injected nodes shadow the legitimate references, letting the attacker control the state objects consumed by Project view logic.

Once state is clobbered, downstream JavaScript treats attacker-controlled attributes as trusted configuration. This can cause the client to send POST requests to backend endpoints under the authenticated privileged user's session, resulting in unauthorized backend interactions.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The HTML sanitizer permits id attributes that collide with reserved data-island identifiers used by client-side code, enabling the DOM clobbering pattern.

Attack Vector

Exploitation is network-based and requires user interaction. An authenticated attacker on the GitHub Enterprise Server instance publishes crafted content, such as an issue, comment, or Project description, containing conflicting HTML elements. A privileged user must then view that content. The victim's browser parses the injected markup, the clobbered state is consumed by Project view scripts, and unauthorized backend actions are executed under the victim's privileges.

No public proof-of-concept code is available for CVE-2025-14046.
Refer to the GitHub Enterprise Server release notes listed in the references
for vendor-provided technical details.

Detection Methods for CVE-2025-14046

Indicators of Compromise

Unexpected POST requests originating from privileged user sessions to Project-related API endpoints without a corresponding user-initiated UI action.
Issues, comments, or Project items containing HTML elements with id attributes that mirror internal application state names.
Access log entries showing sequential Project state modifications immediately after a privileged user opens attacker-authored content.

Detection Strategies

Audit HTTP access logs on the GitHub Enterprise Server appliance for POST requests to Project endpoints correlated with page views of user-generated content.
Review stored issue and Project content for HTML with suspicious id attributes referencing internal identifiers.
Correlate privileged account activity against expected workflow patterns to surface anomalous state-change requests.

Monitoring Recommendations

Enable and forward GitHub Enterprise Server audit logs to a centralized log platform for retention and query.
Alert on Project state mutations performed by administrator or owner accounts shortly after opening third-party content.
Monitor upgrade status across all GitHub Enterprise Server appliances to confirm patched versions are deployed.

How to Mitigate CVE-2025-14046

Immediate Actions Required

Upgrade GitHub Enterprise Server to 3.18.3, 3.17.9, 3.16.12, 3.15.16, or 3.14.21 depending on the deployed release branch.
Restrict administrative and Project owner accounts from browsing untrusted user content until the appliance is patched.
Review recent Project modifications performed by privileged users for unauthorized changes.

Patch Information

GitHub has released fixed builds for each supported branch. See the GitHub Release Notes 3.18.3, GitHub Release Notes 3.17.9, GitHub Release Notes 3.16.12, GitHub Release Notes 3.15.16, and GitHub Release Notes 3.14.21 for release-specific fix details.

Workarounds

No vendor-supplied workaround exists; upgrading the appliance is the required remediation.
As an interim measure, limit privileged users' interaction with content authored by lower-trust accounts.
Enforce role separation so administrators do not routinely browse issues or Projects created by external contributors.

bash

# Verify installed GitHub Enterprise Server version on the appliance
ghe-version

# Apply an upgrade package for the appropriate release branch
ghe-upgrade /path/to/github-enterprise-<version>.pkg