Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push

Summary

Researchers at Wiz discovered CVE-2026-3854, a critical command injection vulnerability in GitHub.com and GitHub Enterprise Server (CVSS 8.7) allowing authenticated users to achieve remote code execution through a single git push command. The flaw stems from improper sanitization of user-supplied git push option values before inclusion in internal service headers, enabling attackers to inject arbitrary metadata and execute commands as the git user. GitHub patched the vulnerability within two hours of disclosure on March 4, 2026, but approximately 88% of instances were vulnerable at the time of public announcement.

Full text

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push Ravie LakshmananApr 28, 2026Vulnerability / Software Security Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command. The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve remote code execution on the instance. "During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers," per a GitHub advisory for the vulnerability. "Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values." Google-owned cloud security firm Wiz has been credited with discovering and reporting the issue on March 4, 2026, with GitHub validating and deploying a fix to GitHub.com within two hours. The vulnerability has also been addressed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0, or later. There is no evidence that the issue was ever exploited in a malicious context. According to GitHub, the issue affects GitHub.com, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, GitHub Enterprise Cloud with Enterprise Managed Users, and GitHub Enterprise Server. At its core, the problem stems from the fact that user-supplied git push options are not adequately sanitized before the values were incorporated into the internal X-Stat header. Because the internal metadata format relies on a semicolon as a delimiter character that could also appear in the user input, a bad actor could exploit this oversight to inject arbitrary commands and have them executed. "By chaining several injected values together, the researchers demonstrated that an attacker could override the environment the push was processed in, bypass sandboxing protections that normally constrain hook execution, and ultimately execute arbitrary commands on the server," GitHub's Chief Information Security Officer, Alexis Wales, said. Wiz, in a coordinated announcement, noted that the issue is "remarkably easy" to exploit, adding that it allows remote code execution on shared storage nodes. About 88% of instances are currently vulnerable to the issue at the time of public disclosure. The remote code execution chain strings together three injections - Inject a non-production rails_env value to bypass the sandbox Inject custom_hooks_dir to control to redirectthe hook directory Inject repo_pre_receive_hooks with a crafted hook entry that triggers path traversal to execute arbitrary commands as the git user "With unsandboxed code execution as the git user, we had full control over the GHES instance, including filesystem read/write access and visibility into internal service configuration," Wiz security researcher Sagi Tzadik said. As for GitHub.com, an enterprise mode flag – that's set to "true" for GitHub Enterprise Server – defaults to "false," rendering the custom hooks path inactive. But since this flag is also passed in the X-Stat header, it's equally injectable using the same mechanism, thereby resulting in code execution on GitHub.com as well. To make matters worse, given GitHub's multi-tenant architecture and its shared backend infrastructure, the company pointed out that obtaining code execution on GitHub.com enabled cross-tenant exposure, effectively allowing an attacker to read millions of repositories on the shared storage node, irrespective of the organization or user. In light of the severity of CVE-2026-3854, users are advised to apply the update immediately for optimal protection. "A single git push command was enough to exploit a flaw in GitHub's internal protocol and achieve code execution on backend infrastructure," Wiz said. "When multiple services written in different languages pass data through a shared internal protocol, the assumptions each service makes about that data become a critical attack surface." "We encourage teams building multi-service architectures to audit how user-controlled input flows through internal protocols – especially where security-critical configuration is derived from shared data formats." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, Command Injection, cybersecurity, DevOps, Enterprise Software, GitHub, remote code execution, software security, Vulnerability Trending News Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages Vercel Finds More Compromised Accounts in Context.ai-Linked Breach ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking and More Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately Popular Resources Discover Key AI Security Gaps CISOs Face in 2026 Fix Rising Application Security Risks Driven by AI Development Automate Alert Triage and Investigations Across Every Threat How to Identify Risky Browser Extensions in Your Organization

Indicators of Compromise

• cve — CVE-2026-3854

Entities