CVE-2024-0200

Unsafe Reflection in Github Enterprise Server leading to Command Injection

7.2 High

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

71.7%Up 71.4 points since Jan 24, 2024

What each source reports

CVE List Score used 7.2

Unsafe Reflection in Github Enterprise Server leading to Command Injection

Record: CVE-2024-0200
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Weakness: CWE-470
Updated: 2026-11-02

EUVDEUVD-2024-15999 7.2

Record: EUVD-2024-15999
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g39r-hh73-78xj 7.2

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to...

Record: GHSA-g39r-hh73-78xj
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Weakness: CWE-470
Updated: 2026-11-02

NVD 7.2

Record: CVE-2024-0200
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-470
Updated: 2026-11-02

Affected products

github enterprise server

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Github Enterprise - Remote Code Execution

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-0200 is a high vulnerability (CVSS 7.2) in Github Enterprise Server, published January 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 71.7%, the 99th percentile. No source names a fixed version.