CVE-2026-10585 Overview
CVE-2026-10585 is a stored cross-site scripting (XSS) vulnerability in GitHub Enterprise Server. An authenticated attacker can inject arbitrary JavaScript into another user's browser by placing a crafted payload in the title of a Discussion in the Q&A category. The AnsweredQuestionStructuredDataComponent fails to escape user-controlled Discussion titles before embedding them in a <script type="application/ld+json"> block. Attackers can escalate the injection to full XSS by abusing JSONP callback support in the REST API to bypass the Content Security Policy (CSP). The vulnerability affects all versions of GitHub Enterprise Server prior to 3.21 and is tracked under [CWE-79].
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, leading to session compromise, account takeover, and unauthorized access to private repositories on the affected GitHub Enterprise Server instance.
Affected Products
- GitHub Enterprise Server versions prior to 3.16.20
- GitHub Enterprise Server 3.17.x prior to 3.17.17, 3.18.x prior to 3.18.11, 3.19.x prior to 3.19.8
- GitHub Enterprise Server 3.20.x prior to 3.20.4
Discovery Timeline
- 2026-06-30 - CVE-2026-10585 published to NVD
- 2026-07-02 - Last updated in NVD database
- Reported via the GitHub Bug Bounty program
Technical Details for CVE-2026-10585
Vulnerability Analysis
The vulnerability resides in the AnsweredQuestionStructuredDataComponent, which renders Schema.org structured data for answered Q&A Discussions. This component embeds the Discussion title directly into a <script type="application/ld+json"> block without escaping characters that terminate the script context. An authenticated attacker who can create a Discussion in the Q&A category can supply a title containing </script> sequences and subsequent HTML, breaking out of the JSON-LD block and injecting attacker-controlled markup into the page.
While GitHub Enterprise Server enforces a strict Content Security Policy that normally blocks inline scripts, the researcher demonstrated a bypass using JSONP callback support in the REST API. By loading an API endpoint that reflects an attacker-supplied callback name as executable JavaScript, the payload achieves full script execution in the origin of the GitHub Enterprise Server instance.
Root Cause
The root cause is missing output encoding of user-controlled input before embedding it inside a <script> element. JSON-LD blocks are treated as script contexts by browsers, so untrusted data placed inside them must be escaped to prevent script-tag breakout. Reliance on CSP as a mitigating control is undermined by the presence of a JSONP endpoint in the same origin.
Attack Vector
An attacker with an authenticated account creates a new Discussion in the Q&A category on a vulnerable GitHub Enterprise Server instance. The Discussion title contains a payload that closes the JSON-LD script tag and loads a JSONP endpoint with an attacker-controlled callback parameter. When another authenticated user views the Discussion, the crafted title breaks out of the script context, triggers the JSONP-based CSP bypass, and executes arbitrary JavaScript in the victim's session on the GitHub Enterprise Server origin.
No verified public proof-of-concept code is available. See the GitHub Enterprise Server 3.20.4 release notes for the vendor description.
Detection Methods for CVE-2026-10585
Indicators of Compromise
- Discussion titles containing </script> sequences, angle brackets, or JSON-LD-breaking characters in the Q&A category
- REST API requests to JSONP-supporting endpoints with unusual or script-like callback parameter values
- Unexpected outbound requests from user browsers to attacker-controlled domains shortly after rendering a Q&A Discussion page
Detection Strategies
- Review Discussion titles across Q&A categories for HTML metacharacters and script-tag fragments using database or API queries against the GitHub Enterprise Server instance
- Inspect web server and application logs for REST API calls that include callback= parameters, particularly those referencing DOM sinks or function names not used by legitimate integrations
- Correlate Discussion creation events with subsequent authenticated session anomalies such as new personal access token creation or SSH key additions
Monitoring Recommendations
- Enable and forward GitHub Enterprise Server audit log events for discussion.create and discussion.update actions to a central log platform for retrospective search
- Monitor Content Security Policy violation reports if the CSP report endpoint is configured, focusing on script-src violations originating from Discussion pages
- Alert on repeated API access to JSONP-capable endpoints from a single account within short time windows
How to Mitigate CVE-2026-10585
Immediate Actions Required
- Upgrade GitHub Enterprise Server to 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20 depending on the currently deployed release branch
- Audit existing Discussions in Q&A categories for suspicious titles containing HTML or script markup and remove or edit them
- Rotate authentication tokens, session cookies, and SSH keys for accounts that may have viewed malicious Discussions prior to patching
Patch Information
GitHub released fixed versions across all supported release branches. Refer to the vendor release notes for each branch: 3.16.20, 3.17.17, 3.18.11, 3.19.8, and 3.20.4. Instances running any version prior to 3.21 without these patches remain exposed.
Workarounds
- Disable the Discussions feature at the organization or enterprise level until the patch is applied
- Restrict Discussion creation permissions in Q&A categories to trusted users only
- Monitor and manually review new Discussion titles for suspicious content until upgrade windows can be scheduled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
