CVE-2026-3854: A simple git push could open the door to remote code execution at GitHub and GitHub Enterprise Server

Security researchers have revealed critical vulnerability at GitHub.com and GitHub Enterprise Server that allowed an authenticated user to achieve remote code execution (CERs) with a single git push. Registered as CVE-2026-3854 with a CVSS score of 8.7, the failure was a clear case of command injection caused by the lack of sanitation of push option provided by the user before including them in an internal header (X-Stat) used by internal GitHub services.

The technical problem was that the internal format of metadata used a point and coma as delimiter, and the values provided by the user could contain that character. With specially built fields, an attacker with push permission could inject additional metadata that, when chained, overturned sandboxing protections and redirected the execution of hooks to routes controlled by the attacker. Wiz researchers demonstrated an operating chain that modified root _ env, custom _ hooks _ dir and repo _ pre _ receive _ hooks to get execution of commands such as git user and access shared storage.

Wiz reported the ruling to GitHub on 4 March 2026; GitHub responded quickly and deployed a correction to GitHub.com within hours. The corrected versions of GitHub Enterprise Server are 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0 or later. GitHub indicates that there is no evidence of known malicious exploitation, but the ease of exploitation and the potential for cross-border access between tenants in shared infrastructure makes the finding a serious risk for business and multi-tenant environments.

The practical implications go beyond the classic back door: with unrestricted CERs such as git user in shared storage nodes, an attacker can read and write repositories from multiple organizations, expose secrets, and compromise integrity and availability of software supply chains. In addition, the incident highlights a recurrent architectural risk: when several services in different languages share internal protocols with different assumptions about the data format, these assumptions become an attack surface.

If you manage GitHub Enterprise Server, the immediate and non-negotiable action is to update to one of the corrected versions mentioned above. For GitHub.com users, GitHub applied the mitigation on the public platform, but it still suits hearing access and recent activity, rotate tokens and keys with high privileges, and check logs for atypical puches or use unusual push options. In all cases, reduce to a minimum the number of accounts with direct push permission to protected branches and require automated revisions from CI for deployment.

Beyond the patch, response and detection measures are recommended: verify the integrity of critical repositories, inspect hooks and settings on servers, search for changes in configuration files or hooks directories, review audit flows and alerts, and, if there are commitment signals, activate the incident response plan, isolate affected instances and restore from secure known copies. It is also prudent to rotate service credentials (tokens, SSH keys, deployment keys) associated with sensitive repositories.

In terms of long-term prevention, organisations and suppliers should strengthen the principle of in-depth defence: validation and comprehensive sanitation of any user input, avoid internal formats that depend on ambiguous delimiters, multi-tenant storage segmentation, and fuzzing and cross-review tests at points where several services interpret the same protocol. Equipment that build distributed architectures should audit how user-controlled data flow through internal protocols and what format assumptions each service does.

Finally, those who manage repositories should be kept informed by reading official communications and technical documentation: GitHub's safety notices page is a good starting point for checking affected details and versions ( https: / / github.com / advices), and git documentation on push options helps to understand how these options can travel in a push ( https: / / git-scm.com / docs / git-push # _ push _ options). For technical analysis and discoverer recommendations, the firm's research page that reported the failure also provides operational context on the operating chain and recommended mitigation ( https: / / www.wiz.io / blog).

In short, CVE-2026-3854 is a reminder that even daily operations like a git push can become commitment vectors if the inputs are not validated at all points of the infrastructure. Now, check your telemetry and tighten your permissions: exposure is real and prevention depends on both timely corrections and sustainable architectural changes.