Skip to content
OpenAdvisories

Vendor

GitHub

165 known vulnerabilities.

Products

Enterprise Server 93 GitHub Enterprise Server 46 cmark-gfm 10 OpenSearch 3 codeql-action 2 github-mcp-server 2 copilot-cli 2 view_component 1 trilogy 1 Webiness Inventory 1 secure_headers 1 paste-markdown 1 vscode-codeql 1 codeql-cli-binaries 1 cli 0
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.5
    CVE-2026-45033 Public exploit

    GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

    GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbit…

    GitHub copilot-cli @github/copilot npm
  • Medium 5.3
    CVE-2026-3306 Public exploit

    Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access

    An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a proje…

    GitHub Enterprise Server
  • High 8.7
    CVE-2026-3854 Public exploit EPSS 42%

    Remote code execution via git push option injection in GitHub Enterprise Server

    An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push…

    GitHub Enterprise Server
  • High 7.1
    CVE-2026-1999 Public exploit

    Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests

    An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository without having push access by exploiting an authorization bypass in the enable_auto_merge mutation f…

    GitHub Enterprise Server
  • High 7.6
    CVE-2025-23369 Public exploit

    Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

    An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an e…

    GitHub Enterprise Server
  • Medium 6.5
    CVE-2024-0507 Public exploit EPSS 66%

    Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

    An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed…

    GitHub Enterprise Server