{"id":745,"date":"2026-04-28T19:03:46","date_gmt":"2026-04-28T19:03:46","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=745"},"modified":"2026-04-28T19:03:46","modified_gmt":"2026-04-28T19:03:46","slug":"researchers-discover-critical-github-cve-2026-3854-rce-flaw-exploitable-via-single-git-push","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=745","title":{"rendered":"Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 28, 2026<\/span><\/span>Vulnerability \/ Software Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single \u00abgit push\u00bb command.<\/p>\n

The flaw, tracked as CVE-2026-3854<\/strong> (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve remote code execution on the instance.<\/p>\n

\u00abDuring a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers,\u00bb per a GitHub advisory<\/a> for the vulnerability. \u00abBecause the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values.\u00bb<\/p>\n

Google-owned cloud security firm Wiz has been credited with discovering and reporting the issue on March 4, 2026, with GitHub validating and deploying a fix to GitHub.com within two hours.<\/p>\n

The vulnerability has also been addressed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0, or later. There is no evidence that the issue was ever exploited in a malicious context.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

According to GitHub, the issue affects GitHub.com, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, GitHub Enterprise Cloud with Enterprise Managed Users, and GitHub Enterprise Server.<\/p>\n

<\/p>\n

At its core, the problem stems from the fact that user-supplied git push options<\/a> are not adequately sanitized before the values were incorporated into the internal X-Stat header. Because the internal metadata format relies on a semicolon as a delimiter character that could also appear in the user input, a bad actor could exploit this oversight to inject arbitrary commands and have them executed.<\/p>\n

\"\"<\/a><\/div>\n

\u00abBy chaining several injected values together, the researchers demonstrated that an attacker could override the environment the push was processed in, bypass sandboxing protections that normally constrain hook execution, and ultimately execute arbitrary commands on the server,\u00bb GitHub’s Chief Information Security Officer, Alexis Wales, said<\/a>.<\/p>\n

Wiz, in a coordinated announcement, noted that the issue is \u00abremarkably easy\u00bb to exploit, adding that it allows remote code execution on shared storage nodes. About 88% of instances are currently vulnerable to the issue at the time of public disclosure. The remote code execution chain strings together three injections –<\/p>\n