The issue is related to Cross-site Scripting in the tag name pattern field in the tag protections UI. This allows a malicious website, requiring user interaction and social engineering, to make changes to a user account via CSP bypass with created CSRF tokens. The vulnerability was reported via the GitHub Bug Bounty program.