CVE-2026-10585

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description A stored cross-site scripting issue exists where an authenticated attacker can execute arbitrary JavaScript in another user's browser. This occurs by injecting a crafted payload into the title of a Discussion within the Q&A category. The AnsweredQuestionStructuredDataComponent fails to escape user-controlled Discussion titles before embedding them in a <script type="application/ld+json"> block, enabling the title to break out of the script context. The attack is further escalated by leveraging JSONP (JSON with Padding, a technique to allow cross-domain data requests) callback support in the REST API to bypass the Content Security Policy.

Recommendations Update to version 3.20.4 Update to version 3.19.8 Update to version 3.18.11 Update to version 3.17.17