EIP-2026-114696

PRE-CVE

GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114696. PoCs published by iblue.

AI-analyzed exploit summary This Ruby script exploits a deserialization vulnerability in GitHub Enterprise (2.8.0-2.8.6) by crafting a malicious cookie with a serialized payload. The payload leverages Ruby's Marshal format to execute arbitrary code via a DeprecatedInstanceVariableProxy object.

Description

GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution

Exploits (1)

exploitdb WORKING POC VERIFIED
by iblue · rubywebappsruby
https://www.exploit-db.com/exploits/41616

This Ruby script exploits a deserialization vulnerability in GitHub Enterprise (2.8.0-2.8.6) by crafting a malicious cookie with a serialized payload. The payload leverages Ruby's Marshal format to execute arbitrary code via a DeprecatedInstanceVariableProxy object.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: GitHub Enterprise 2.8.0 - 2.8.6
No auth needed
Prerequisites: Network access to the target GitHub Enterprise instance · Target must be running a vulnerable version (2.8.0-2.8.6)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026