CVE-2026-10585: GitHub Enterprise Server Stored XSS in Q&A Discussions

Technical summary

The vulnerability exists in the AnsweredQuestionStructuredDataComponent, which processes Discussion titles for Q&A categories without proper HTML entity encoding before inserting them into JSON-LD script blocks. An authenticated attacker can craft a Discussion title containing a closing script tag followed by arbitrary JavaScript, which breaks the JSON-LD context and executes in the page DOM. The attack surface is further expanded because GitHub Enterprise Server's REST API supports JSONP callbacks, which can be leveraged to circumvent the Content Security Policy restrictions that would normally block such injections. The flaw affects GitHub Enterprise Server versions prior to 3.21, with patches available in 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.

Business impact

Organizations running GitHub Enterprise Server are at risk of session hijacking, credential theft, and unauthorized access to repository data if users are tricked into viewing malicious Q&A discussions created by internal attackers. The attack does not require privilege escalation—any authenticated user can create or modify discussions—making it a concern for insider-threat scenarios or compromised standard user accounts. Data exfiltration and lateral movement within the GitHub environment become possible if an attacker harvests session tokens or personal access tokens from affected users.

Affected systems

All versions of GitHub Enterprise Server prior to version 3.21 are vulnerable. Specifically, patched versions are available in the 3.20.x line (3.20.4 and later), 3.19.x line (3.19.8 and later), 3.18.x line (3.18.11 and later), 3.17.x line (3.17.17 and later), and 3.16.x line (3.16.20 and later). Any instance running versions older than these branch-specific patches remains at risk. Organizations should verify their current version against these thresholds immediately.

Exploitability

Exploitation requires an authenticated account and relies on social engineering to entice victims to view the malicious discussion. The attack is relatively straightforward to execute once a user posts the crafted payload—no additional authentication bypass or privilege escalation is needed. The reliance on user interaction (clicking a link or viewing the discussion) and the requirement for valid credentials keep the CVSS score at Medium (5.4), but the low attack complexity means patching should not be delayed in environments where insider threats or account compromise is a realistic concern.

Remediation

Apply patches immediately for your version branch: 3.20.4+, 3.19.8+, 3.18.11+, 3.17.17+, or 3.16.20+. If you are running version 3.21 or later, you are not affected. Organizations unable to patch immediately should consider disabling or restricting access to Q&A discussions until updates are deployed, and review audit logs for any suspicious Discussion creation or modification activity by authenticated users.

Patch guidance

GitHub has released version-specific patches across multiple release branches. Identify your current GitHub Enterprise Server version (typically available in the web interface under System Settings or via the API), then cross-reference it against the patched versions listed in the vulnerability description. Apply the minimum patch version for your branch—for example, if you run 3.19.x, upgrade to 3.19.8 or later. If you are on an unsupported branch (older than 3.16), contact GitHub support regarding extended support options. Test patches in a staging environment before production deployment to ensure no breakage of existing discussion or API functionality.

Detection guidance

Monitor audit logs for Discussion creation or edits in Q&A categories that contain unusual characters (script tags, angle brackets, JavaScript keywords) in titles. GitHub Enterprise Server audit logs should be reviewed for any authenticated user activity involving AnsweredQuestion or Discussion-related API endpoints. Network-level monitoring for JSONP callback patterns in REST API requests may reveal exploitation attempts. Additionally, scan running instances for HTTP responses containing unescaped user input within <script type="application/ld+json"> blocks, which would indicate the vulnerability is present.

Why prioritize this

Although the CVSS score is Medium, the vulnerability should be prioritized for rapid patching because it affects a centralized platform (source code repository) where unauthorized access can have cascading consequences. The requirement for only basic authentication and the relative ease of exploitation make it attractive to insider threats or account takeover scenarios. Many organizations treat GitHub Enterprise Server as a critical security boundary, making stored XSS in core features a significant risk to patch velocity and incident response planning.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium) reflects the need for prior authentication and user interaction. The attack vector is Network, Attack Complexity is Low, Privileges Required is Low (any authenticated user), and User Interaction is Required (victim must view the discussion). The impact is limited to Confidentiality and Integrity with no Availability impact. However, the Scope is Changed, meaning the vulnerability can affect resources beyond the vulnerable component—specifically, other users' sessions. This score appropriately captures the threat as non-critical but meaningful; organizations should not deprioritize patching based solely on the Medium rating.

Frequently asked questions