CVE-2025-3246
📋 TL;DR
A cross-site scripting vulnerability in GitHub Enterprise Server allows attackers to inject malicious scripts into math blocks using $$..$$ delimiters. This affects organizations running GitHub Enterprise Server version 3.16.1, requiring both access to the instance and privileged user interaction for exploitation.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Privileged user executes malicious JavaScript leading to session hijacking, data theft, or administrative account compromise.
Likely Case
Targeted phishing campaign against privileged users leads to limited data exposure or account takeover.
If Mitigated
With proper access controls and user awareness, impact is limited to isolated incidents with minimal data exposure.
🎯 Exploit Status
Exploitation requires authenticated access to create malicious content and privileged user interaction to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.16.2
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Download version 3.16.2 from GitHub Enterprise. 3. Follow the upgrade procedure for your deployment method. 4. Restart services as required.
🔧 Temporary Workarounds
Disable Markdown rendering
allTemporarily disable Markdown rendering for math blocks to prevent exploitation
Not applicable - configuration change via admin console
Restrict user content creation
allLimit which users can create content with Markdown math blocks
Not applicable - policy/configuration change
🧯 If You Can't Patch
- Implement strict content security policies to limit script execution
- Increase monitoring for suspicious Markdown content and user interactions
🔍 How to Verify
Check if Vulnerable:
Check GitHub Enterprise Server version via admin console or SSH: cat /data/user/common/enterprise-versionCheck Version:
cat /data/user/common/enterprise-versionVerify Fix Applied:
Confirm version is 3.16.2 or higher and test Markdown math block rendering📡 Detection & Monitoring
Log Indicators:
- Unusual Markdown content creation patterns
- Multiple failed XSS attempts in audit logs
Network Indicators:
- Suspicious JavaScript payloads in HTTP requests to Markdown endpoints
SIEM Query:
source="github_audit" AND (event="markdown.render" OR event="content.create") AND content CONTAINS "$$"