CVE-2020-10518

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
GitHub	GitHub Enterprise Server	>= 2.19, < 2.19.21; >= 2.20, < 2.20.15; >= 2.21, < 2.21.6

References

https://enterprise.github.com/releases/2.19.21/notesRelease Notes, Vendor Advisory
https://enterprise.github.com/releases/2.20.15/notesRelease Notes, Vendor Advisory
https://enterprise.github.com/releases/2.21.6/notesRelease Notes, Vendor Advisory
https://enterprise.github.com/releases/2.19.21/notesRelease Notes, Vendor Advisory
https://enterprise.github.com/releases/2.20.15/notesRelease Notes, Vendor Advisory
https://enterprise.github.com/releases/2.21.6/notesRelease Notes, Vendor Advisory

Timeline

Published: Aug 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-105198.8A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. CVE-2020-10527.8<p>An elevation of privilege vulnerability exists in the way that the ssdpsrv.dll handles objects in memory. An attacker who successfully ex CVE-2020-10537.8<p>An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited CVE-2020-105318.8An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based b CVE-2020-105327.5The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/l CVE-2020-105349.8In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked CVE-2020-105355.3GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace p CVE-2020-105377.8An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP port 4848. No passwor CVE-2020-105385.5An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute CVE-2020-105399.8An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user login, checks the s CVE-2020-10547.0An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An CVE-2020-105408.8Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules.