Read the docs
TI-2020-08452 Aliases CVE-2020-10518GHSA-m5vm-44r4-56mf

Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

Priority MEDIUM 44CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.

Why it matters now

EPSS 0.03699 89th percentileScored 2026-11-07
Fix Fixed GitHub Enterprise Server (GitHub): 2.19.21, 2.20.15, 2.21.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitHubGitHub Enterprise Server2.19 to before 2.19.21; 2.20 to before 2.20.15; 2.21 to before 2.21.62.19.21, 2.20.15, 2.21.6Patch availableCNA
  • GitHub Enterprise Server VendorGitHub Affected 2.19 to before 2.19.21; 2.20 to before 2.20.15; 2.21 to before 2.21.6 Fixed in 2.19.21, 2.20.15, 2.21.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:*before 2.19.21; 2.20.0 to before 2.20.15; 2.21.0 to before 2.21.6VulnerableGitHub
  • cpe:2.3:a:github:github:*:*:*:*:enterprise:*:*:* Versions before 2.19.21; 2.20.0 to before 2.20.15; 2.21.0 to before 2.21.6 Vulnerable ·GitHub

Remediation

  • Fix · CNA GitHub Enterprise Server (GitHub) Fixed in 2.19.21, 2.20.15, 2.21.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitHub Enterprise Server 2.19.21, 2.20.15, 2.21.6

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-08451 Improper access control in GitHub Enterprise Server leading to the enumeration of private repository namesPriority LOW 22
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10518
  2. 2026-10-03 Alias added: GHSA-m5vm-44r4-56mf

References

Advisory 3

  • TI-2017-13538 The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization… CVSS 3.0CRITICAL 9.8
  • TI-2020-08450 Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member CVSS 3.1CRITICAL 9.8
  • TI-2020-08453 Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server CVSS 3.1HIGH 8.8
  • TI-2021-05724 Improper authorization in GitHub Enterprise Server CVSS 3.1HIGH 8.1
  • TI-2012-01828 GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide… CVSS 3.1HIGH 7.5
  • TI-2021-05722 Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences