CVE-2025-3246 - CVE House

Back to Database

Status published High CVE-2025-3246

Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers

8.6 CVSS

Vulnerability Description

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user interaction with the malicious elements. This vulnerability affected version 3.16.1 of GitHub Enterprise Server and was fixed in version 3.16.2. This vulnerability was reported via the GitHub Bug Bounty program.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3246

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

André Storfjord Kristiansen

References

https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2

More from GitHub

View All →

Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access

Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access

GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API

Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation

Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names

Affected Vendor

GitHub

View all reports →

Affected Software

GitHub Enterprise Server

Vulnerable Versions:

3.16

Timeline

Official Publish: April 17th, 2025

Last Modified: April 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement