An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs collided server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading unintended server-side POST requests other unauthorized backend interactions. Successful exploitation requires an attacker have access the target instance and entice a privileged user view crafted malicious content includes conflicting elements. This affected all versions prior 3.18.3, 3.17.9, 3.16.12, 3.15.16, 3.14.21.