FAIL › dossier
GitHub
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 20%
GitHub is a critical software development platform that has recently suffered from critical vulnerabilities in its Enterprise Server and CLI tools, as well as supply chain attacks that led to the exfiltration of private repositories. Its security posture is characterized by a mix of rapid patching of critical flaws and recurring issues with supply chain integrity and access management.
PROFILE
CategorySoftware Development PlatformWhat they doGitHub is a web-based Git repository hosting service that provides access control and collaboration features for software development.
Websitehttps://github.com ↗
SECURITY POSTURE
GitHub has a mixed security track record, with recent critical vulnerabilities in its Enterprise Server and CLI tools, alongside supply chain compromises affecting its platform and ecosystem.
Notable failures
- CVE-2026-17556: Unauthenticated file deletion via path traversal in Enterprise Server
- CVE-2026-48501: Unpatched vulnerability in GitHub CLI prior to 2.93.0
- CVE-2024-22051: Integer overflow in CommonMarker dependency
- CrowdSec GitHub repository leak via compromised former employee account
Patterns: Supply chain compromise leading to credential theft and data exfiltration; Unpatched vulnerabilities in CLI and server-side components; Inadequate access revocation for former employees
FAILURE HISTORY · 4
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-09-22 | CVE-2026-77987 | critical | GitHub Enterprise Server's notebook viewer allowed SSRF to internal services, enabling secret extraction and remote code execution. |
| 2026-08-05 | CVE-2026-17556 | critical | Unauthenticated attackers could delete arbitrary files on GitHub Enterprise Server via path traversal in the X-GitHub-Request-Id header. |
| 2026-05-29 | CVE-2026-48501 | high | CVE-2026-48501: GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub |
| 2024-01-04 | CVE-2024-22051 | critical | CVE-2024-22051: CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnera |
FEDRAMP CATALOG PRODUCTS · 1
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| GitHub Enterprise Cloud | Authorized | LI-SaaS |
DOSSIER SOURCES
- Chris Wanstrath - Forbes · www.forbes.com
- Salesforce - Wikipedia · en.wikipedia.org
- Who hosts github.com? Microsoft · www.hostingdetector.com
- CrowdSec GitHub Repository Leak: Former Employee Access · www.redsecuretech.co.uk
- CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub ... · The Hacker News
- 222 GitHub Repositories and the Strategic Imperative of ... - LinkedIn · www.linkedin.com
- Chris Wanstrath - Forbes · www.forbes.com
- The Minds Behind GitHub and Social Coding - 7 People Redefining ... · www.codehistory.org
- Landmark Decision in Doe v. GitHub AI Court Battle · heathermeeker.com
Open questions: GitHub's exact founding year and headquarters location are not explicitly stated in the provided evidence.
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-22 05:08:03.687852+00:00