CVE-2022-23740

score

<0.1

cvss

8.8

epss

1.2%

published

2022-11-23

kev added

—

first seen

2026-10-21

GitHub Enterprise Server 3.7.0 contains a command injection caused by improper neutralization of argument delimiters in GitHub Actions, letting attackers with permission to create and build GitHub Pages execute remote code, exploit requires permission to create and build GitHub Pages.