CVE-2026-4821
published 2026-04-21CVE-2026-4821: An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console…
PriorityP345high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | enterprise_server | < 3.14.26 | 3.14.26 |
| github | enterprise_server | — | — |
| github | enterprise_server | 3.14.0 – 3.14.25 | — |
| github | enterprise_server | >= 3.15.0 < 3.15.21 | 3.15.21 |
| github | enterprise_server | 3.15.0 – 3.15.20 | — |
| github | enterprise_server | >= 3.16.0 < 3.16.17 | 3.16.17 |
| github | enterprise_server | 3.16.0 – 3.16.16 | — |
| github | enterprise_server | >= 3.17.0 < 3.17.14 | 3.17.14 |
| github | enterprise_server | 3.17.0 – 3.17.13 | — |
| github | enterprise_server | >= 3.18.0 < 3.18.8 | 3.18.8 |
| github | enterprise_server | 3.18.0 – 3.18.7 | — |
| github | enterprise_server | >= 3.19.0 < 3.19.5 | 3.19.5 |
| github | enterprise_server | 3.19.0 – 3.19.4 | — |
| github | enterprise_server | >= 3.20.0 < 3.20.1 | 3.20.1 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvelistv5v4.08.1HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6hg9-m8fv-wq83: An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Conso
ghsa_unreviewed·2026-04-22
CVE-2026-4821 [HIGH] CWE-78 GHSA-6hg9-m8fv-wq83: An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Conso
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
CVEList
Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API
cvelistv5·2026-04-21·CVSS 8.1
CVE-2026-4821 [HIGH] CWE-78 Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API
Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.github.com/en/[email protected]/admin/release-notes#3.14.24https://docs.github.com/en/[email protected]/admin/release-notes#3.15.21https://docs.github.com/en/[email protected]/admin/release-notes#3.16.17https://docs.github.com/en/[email protected]/admin/release-notes#3.17.14https://docs.github.com/en/[email protected]/admin/release-notes#3.18.8https://docs.github.com/en/[email protected]/admin/release-notes#3.19.5https://docs.github.com/en/[email protected]/admin/release-notes#3.20.1
2026-04-21
Published