🔐 CVE Alert

CVE-2026-4821

UNKNOWN 0.0

Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

CWE CWE-78
Vendor github
Product enterprise server
Ecosystems
Industries
Technology
Published Apr 21, 2026
Stay Ahead of the Next One

Get instant alerts for github enterprise server

Be the first to know when new unknown vulnerabilities affecting github enterprise server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

GitHub / Enterprise Server
3.20.0 < 3.20.1 3.19.0 ≤ 3.19.4 3.18.0 ≤ 3.18.7 3.17.0 ≤ 3.17.13 3.16.0 ≤ 3.16.16 3.15.0 ≤ 3.15.20 3.14.0 ≤ 3.14.25

References

NVD ↗ CVE.org ↗ EPSS Data ↗
docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.20.1 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.19.5 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.18.8 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.17.14 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.16.17 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.15.21 docs.github.com: https://docs.github.com/en/[email protected]/admin/release-notes#3.14.24

Credits

🔍 Seokchan Yoon