CVE-2026-77912 Overview
CVE-2026-77912 is a stored cross-site scripting (XSS) vulnerability in GitHub Enterprise Server. The Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. An authenticated attacker could inject arbitrary HTML attributes into rendered Markdown. Crafted payloads abused same-origin JavaScript gadgets to bypass Content Security Policy and take control of the page DOM when another user viewed the content. This vulnerability was reported through the GitHub Bug Bounty program and is tracked under [CWE-79].
Critical Impact
An attacker could read content visible to the victim, extract CSRF tokens, perform state-changing actions as the victim, and propagate the payload to repositories and organizations where the victim held write access.
Affected Products
- GitHub Enterprise Server 3.17 series (fixed in 3.17.21)
- GitHub Enterprise Server 3.18 series (fixed in 3.18.15)
- GitHub Enterprise Server 3.19, 3.20, 3.21, and 3.22 series (fixed in 3.19.12, 3.20.8, 3.21.6, and 3.22.1)
Discovery Timeline
- 2026-09-22 - CVE-2026-77912 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-77912
Vulnerability Analysis
The defect resides in the Markdown rendering pipeline of GitHub Enterprise Server. After the HTML sanitizer processed rendered Markdown, a downstream transformation rewrote quote characters within the already-sanitized output. The rewrite ran without re-sanitizing the result, which broke the trust boundary the sanitizer established. An authenticated attacker with permission to author Markdown could craft input that produced attacker-controlled HTML attributes on legitimate elements in the final DOM.
Because the injection happens in the same origin as the GitHub Enterprise Server web UI, the payload can reach same-origin JavaScript gadgets already loaded by the application. Chaining those gadgets bypasses the Content Security Policy (CSP) that normally blocks inline script execution. Once script logic runs under the victim's origin, the attacker can read visible page content, extract embedded CSRF tokens, and issue authenticated requests as the victim.
Root Cause
The root cause is an ordering flaw in the rendering pipeline. Output neutralization must occur after all HTML transformations, but the pipeline mutated post-sanitization HTML. The quote-character rewrite reintroduced attribute-boundary ambiguity that the sanitizer had already resolved, allowing attribute injection [CWE-79].
Attack Vector
An authenticated user submits crafted Markdown to any surface that renders it, such as issues, pull requests, comments, or repository files. When another authenticated user views the rendered content, the injected attributes execute in that user's browser session. The payload can then propagate to any repository or organization where the victim has write access, enabling worm-like spread across the Enterprise Server instance.
No verified proof-of-concept code has been published. Refer to the GitHub Enterprise Server 3.22.1 release notes for vendor detail on the fix.
Detection Methods for CVE-2026-77912
Indicators of Compromise
- Markdown source containing unusual quote-character sequences, HTML entity encodings, or attribute-like fragments inside otherwise benign text.
- Rendered pages that surface unexpected on* event-handler attributes or data-* attributes on standard elements.
- Outbound requests from GitHub Enterprise Server browser sessions to unfamiliar domains during page rendering.
- Bulk edits or state-changing API calls performed by user accounts shortly after they viewed a specific issue, pull request, or file.
Detection Strategies
- Inspect Markdown-bearing content (issues, PRs, comments, wiki pages, README files) for encoded quote sequences that survive the sanitizer.
- Compare pre- and post-render HTML for the same Markdown input to spot attribute-boundary drift.
- Monitor browser console error telemetry and CSP violation reports emitted by GitHub Enterprise Server users.
Monitoring Recommendations
- Ship GitHub Enterprise Server audit logs and reverse-proxy access logs to a centralized analytics platform for correlation.
- Alert on repository content changes performed by an account within seconds of that account loading a Markdown-rendered page.
- Track anomalous cross-repository write activity, especially bursts targeting organizations where a user has broad permissions.
How to Mitigate CVE-2026-77912
Immediate Actions Required
- Upgrade GitHub Enterprise Server to 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, or 3.17.21 depending on the deployed release train.
- Audit recent Markdown content submitted by non-administrative accounts for suspicious attribute injection patterns.
- Rotate any session tokens or CSRF-protected secrets that may have been exposed to users who rendered untrusted Markdown.
Patch Information
GitHub released fixes in GitHub Enterprise Server versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. Consult the vendor release notes for each supported branch: 3.17.21, 3.18.15, 3.19.12, 3.20.8, 3.21.6, and 3.22.1.
Workarounds
- Restrict the ability to author Markdown to trusted accounts until the patch is applied on the instance.
- Require multi-factor authentication on all accounts to raise the cost of a compromised authoring identity.
- Tighten browser-side protections by ensuring users access GitHub Enterprise Server through browsers that enforce CSP strictly and block third-party script loads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
