Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push Ravie LakshmananApr 28, 2026Vulnerability / Software Security Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command. The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve remote code execution on the instance. "During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers," per a GitHub advisory for the vulnerability. "Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values." Google-owned cloud security firm Wiz has been credited with discovering and reporting the issue on March 4, 2026, with GitHub validating and deploying a fix to GitHub.com within two hours. The vulnerability has also been addressed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0, or later. There is no evidence that the issue was ever exploited in a malicious context. According to GitHub, the issue affects GitHub.com, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, GitHub Enterprise Cloud with Enterprise Managed Users, and GitHub Enterprise Server. At its core, the problem stems from the fact that user-supplied git push options are not adequately sanitized before the values were incorporated into the internal X-Stat header. Because the internal metadata format relies on a semicolon as a delimiter character that could also appear in the user input, a bad actor could exploit this oversight to inject arbitrary commands and have them executed. "By chaining several injected values together, the researchers demonstrated that an attacker could override the environment the push was processed in, bypass sandboxing protections that normally constrain hook execution, and ultimately execute arbitrary commands on the server," GitHub's Chief Information Security Officer, Alexis Wales, said. Wiz, in a coordinated announcement, noted that the issue is "remarkably easy" to exploit, adding that it allows remote code execution on shared storage nodes. About 88% of instances are currently vulnerable to the issue at the time of public disclosure. The remote code execution chain strings together three injections - Inject a non-production rails_env value to bypass the sandbox Inject custom_hooks_dir to control to redirectthe hook directory Inject repo_pre_receive_hooks with a crafted hook entry that triggers path traversal to execute arbitrary commands as the git user "With unsandboxed code execution as the git user, we had full control over the GHES instance, including filesystem read/write access and visibility into internal service configuration," Wiz security researcher Sagi Tzadik said. As for GitHub.com, an enterprise mode flag – that's set to "true" for GitHub Enterprise Server – defaults to "false," rendering the custom hooks path inactive. But since this flag is also passed in the X-Stat header, it's equally injectable using the same mechanism, thereby resulting in code execution on GitHub.com as well. To make matters worse, given GitHub's multi-tenant architecture and its shared backend infrastructure, the company pointed out that obtaining code execution on GitHub.com enabled cross-tenant exposure, effectively allowing an attacker to read millions of repositories on the shared storage node, irrespective of the organization or user. In light of the severity of CVE-2026-3854, users are advised to apply the update immediately for optimal protection. "A single git push command was enough to exploit a flaw in GitHub's internal protocol and achieve code execution on backend infrastructure," Wiz said. "When multiple services written in different languages pass data through a shared internal protocol, the assumptions each service makes about that data become a critical attack surface." "We encourage teams building multi-service architectures to audit how user-controlled input flows through internal protocols – especially where security-critical configuration is derived from shared data formats." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Cloud security, Command Injection, cybersecurity, DevOps, Enterprise Software, GitHub, remote code execution, software security, Vulnerability Trending News Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover The Hidden Security Risks of Shadow AI in Enterprises Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released Why Security Leaders Are Layering Email Defense on Top of Secure Email Gateways Your MTTD Looks Great. Your Post-Alert Gap Doesn't Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution OpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain Why Threat Intelligence Is the Missing Link in CTEM Prioritization and Validation Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials Load More ▼ Popular Resources Discover Key AI Security Gaps CISOs Face in 2026 How to Identify Risky Browser Extensions in Your Organization Automate Alert Triage and Investigations Across Every Threat Fix Rising Application Security Risks Driven by AI Development