CVE-2025-11892 is a critical DOM based cross-site scripting flaw in the Issues search label filter of GitHub Enterprise Server, scored 9.6 by NVD. The fix is to upgrade to 3.18.1, 3.17.7, 3.16.10, 3.15.14 or 3.14.19, or any later release in your series. GitHub.com is not mentioned in the record.
What's affected
NVD says all versions of GitHub Enterprise Server before 3.18.1, 3.17.7, 3.16.10, 3.15.14 and 3.14.19 are affected. The fixed releases are therefore:
- 3.18.1 for the 3.18 series
- 3.17.7 for the 3.17 series
- 3.16.10 for the 3.16 series
- 3.15.14 for the 3.15 series
- 3.14.19 for the 3.14 series
The GitHub release notes for these versions list the fix under security fixes, describe the issue as high severity, and say GitHub requested the CVE ID after the report came through the GitHub Bug Bounty program. NVD's CVSS 3.1 score is 9.6, which is why this post calls it critical.
This is a flaw in GitHub Enterprise Server, the self hosted product. The advisory material does not cover GitHub.com.
How to check if you're exposed
Find your version. Administrators can read it in the Management Console, or print it from the administrative shell:
ghe-version
Compare the result to the fixed list above. If your series is not in that list, read the release notes for your series, and plan a move to one that is.
The record also sets a condition. An attacker needs access to the instance and must entice a user, who is in sudo mode, to click a crafted link. If you have a small group of trusted users and an instance behind a VPN, the risk is lower than for a widely open instance, though not zero.
What to do now
- Upgrade to the fixed release for your series: 3.18.1, 3.17.7, 3.16.10, 3.15.14 or 3.14.19, or newer. Back up first and follow GitHub's upgrade documentation.
- If you cannot upgrade today, tell site administrators not to click links to the instance from messages, tickets or chats while they are in sudo mode, and to leave sudo mode when they are done with admin tasks.
- Review who has accounts on the instance. The attack needs an account, so remove stale users.
- Check audit logs for unexpected workflow triggers or privilege changes over the period before you upgraded. The record names unauthorized workflow triggers as a possible result.
- Add your instance version to a patch tracker so the next release note gets read the day it ships.
Why it matters
The record describes improper neutralization of input, which leads to DOM based cross-site scripting. The weakness class is CWE-79. In DOM XSS the page's own JavaScript takes part of the URL, here the label filter value in Issues search, and writes it into the page without proper sanitization. A crafted link then runs script in the victim's browser session.
The release notes describe the impact as session hijacking, account takeover and recovery code exfiltration for an ordinary user. The CVE description adds privilege escalation and unauthorized workflow triggers when the victim is an administrator in sudo mode. Workflow triggers matter because a CI pipeline is a path to secrets and to code.
The record does not mark this as exploited in the wild and it is not in the CISA Known Exploited Vulnerabilities catalog. Self hosted source control is a high value system, so patch on your normal fast track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect GitHub.com?
The record and release notes are about GitHub Enterprise Server. They do not mention GitHub.com, so this post makes no claim about it.
Does a user need to be an admin to be a victim?
No. The release notes describe session hijacking and account takeover for ordinary users. The record adds that the privilege escalation and workflow trigger impact apply when the victim is in sudo mode.
Sources
Last reviewed: 19 October 2026.
