CVE-2025-11892 DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

[
  {
    "defaultStatus": "affected",
    "product": "Enterprise Server",
    "vendor": "GitHub",
    "versions": [
      {
        "changes": [
          {
            "at": "3.18.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "3.18.1",
        "status": "affected",
        "version": "3.18.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.17.7",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.17.6",
        "status": "affected",
        "version": "3.17.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.16.10",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.16.9",
        "status": "affected",
        "version": "3.16.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.15.14",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.15.13",
        "status": "affected",
        "version": "3.15.0",
        "versionType": "semver"
      },
      {
        "changes": [
          {
            "at": "3.14.19",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.14.18",
        "status": "affected",
        "version": "3.14.0",
        "versionType": "semver"
      }
    ]
  }
]