CVE-2026-10585
Full vulnerability record from the local CVENow database.
Description
A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's browser by injecting a crafted payload into the title of a Discussion in the Q&A category. The AnsweredQuestionStructuredDataComponent did not escape user-controlled Discussion titles before embedding them in a <script type="application/ld+json"> block, allowing the title to break out of the script context. The injection was escalated to a full cross-site scripting attack on GitHub Enterprise Server by leveraging JSONP callback support in the REST API to bypass the Content Security Policy. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-30 22:16:45.483000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-10585",
"sourceIdentifier": "[email protected]",
"published": "2026-06-30T22:16:45.483",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's browser by injecting a crafted payload into the title of a Discussion in the Q&A category. The AnsweredQuestionStructuredDataComponent did not escape user-controlled Discussion titles before embedding them in a <script type=\"application/ld+json\"> block, allowing the title to break out of the script context. The injection was escalated to a full cross-site scripting attack on GitHub Enterprise Server by leveraging JSONP callback support in the REST API to bypass the Content Security Policy. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Una vulnerabilidad de cross-site scripting almacenado fue identificada en GitHub Enterprise Server que permitía a un atacante autenticado ejecutar JavaScript arbitrario en el navegador de otro usuario inyectando una carga útil manipulada en el título de una Discusión en la categoría de Preguntas y Respuestas. El AnsweredQuestionStructuredDataComponent no escapaba los títulos de Discusión controlados por el usuario antes de incrustarlos en un bloque [script_tag], permitiendo que el título saliera del contexto del script. La inyección fue escalada a un ataque completo de cross-site scripting en GitHub Enterprise Server aprovechando el soporte de devolución de llamada JSONP en la API REST para eludir la Política de Seguridad de Contenido. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. Esta vulnerabilidad fue reportada a través del programa de recompensas por errores de GitHub."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "affected",
"versions": [
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.16",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.17",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.10",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.11",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.7",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.8",
"status": "unaffected"
}
]
},
{
"version": "3.20.0",
"lessThanOrEqual": "3.20.3",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.4",
"status": "unaffected"
}
]
},
{
"version": "3.16.0",
"lessThanOrEqual": "3.16.19",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.16.20",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-01T15:36:51.127934Z",
"id": "CVE-2026-10585",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.20",
"matchCriteriaId": "09FDB053-8EF5-4CAF-9C05-090985C57A77"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.17.0",
"versionEndExcluding": "3.17.17",
"matchCriteriaId": "F0612BD3-C04E-4A34-ACEF-4D1F4F723E47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.11",
"matchCriteriaId": "0553891C-ED0B-4D2C-A832-29996F0CE8B2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.8",
"matchCriteriaId": "E67B4A61-E777-4B50-8DFC-DDF6292C4771"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.20.0",
"versionEndExcluding": "3.20.4",
"matchCriteriaId": "A51E85E4-FF55-497C-A39F-F69E224E63BD"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.20",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4",
"source": "[email protected]",
"tags": [
"Release Notes"
]
}
]
}