CVE-2022-23740 - CVE House
Back to Database
Status published Unknown CVE-2022-23740

Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution

Vulnerability Description

CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23740

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • yvvdwf

References

More from GitHub

View All →
CVE-2025-8447
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access
High 7
CVE-2025-6981
Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access
Medium 5.3
CVE-2025-6600
GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API
Medium 6.3
CVE-2025-3509
Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
High 7.1
CVE-2025-3246
Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers
High 8.6

Affected Vendor

Affected Software

GitHub Enterprise Server
Vulnerable Versions:
3.7

Timeline

Official Publish: November 23rd, 2022
Last Modified: April 28th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-88

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation