Critical GitHub Vulnerability Enables Remote Code Execution with a Single Git Push

If your business uses GitHub to manage code, host internal projects, or collaborate with developers, you need to know about CVE-2026-3854 — a critical vulnerability that allows an attacker to achieve full remote code execution with nothing more than a single git push command.

This isn't theoretical. Researchers demonstrated the full exploit chain, and the implications for businesses running GitHub Enterprise Server are severe.

What Is CVE-2026-3854?

CVE-2026-3854 carries a CVSS score of 8.7 and affects GitHub.com, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, GitHub Enterprise Cloud with Enterprise Managed Users, and GitHub Enterprise Server. At its core, it's a command injection vulnerability rooted in how GitHub handles user-supplied data during a git push operation.

Here's the plain-English version of what went wrong: when you push code to GitHub, internal services pass metadata back and forth to coordinate the operation. GitHub uses a special character — a semicolon — as a delimiter in this internal metadata format. The problem is that user-supplied "push option" values were embedded directly into those internal headers without being sanitized first.

As The Hacker News explains, because that same semicolon delimiter could appear in user input, an attacker could craft malicious push option values to inject additional metadata fields — essentially smuggling commands into a part of the system that trusted them completely.

How the Attack Actually Works

Google-owned cloud security firm Wiz discovered and reported the vulnerability on March 4, 2026, and GitHub validated and deployed a fix to GitHub.com within two hours. Wiz researcher Sagi Tzadik described what a successful exploit looks like in practice.

The attack chains three injections together:

1. Inject a non-production rails_env value to bypass the sandbox that normally constrains how hooks execute.
2. Inject a custom hooks_dir to redirect where GitHub looks for hook scripts, pointing it somewhere the attacker controls.
3. Inject a crafted repo_pre_receive_hooks entry that uses path traversal to execute arbitrary commands as the git service user.

The result? As Tzadik noted, attackers gain "full control over the GHES instance, including filesystem read/write access and visibility into internal service configuration."

On GitHub.com itself, the attack path is slightly different but equally dangerous. An enterprise mode flag that's normally set to false on GitHub.com is passed through the same injectable X-Stat header, meaning attackers can flip it and achieve code execution there too.

Worse still, because of GitHub's multi-tenant architecture and shared backend infrastructure, Security Affairs reports that code execution on GitHub.com could expose data across environments — potentially allowing an attacker to read millions of repositories on shared storage nodes, regardless of which organization or user owns them.

Who Is at Risk Right Now?

GitHub has already patched GitHub.com and GitHub Enterprise Cloud. The urgent concern is GitHub Enterprise Server — the self-hosted version that many businesses run on their own infrastructure.

Patched Enterprise Server versions include 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0, and later. But according to Wiz, at the time of public disclosure, 88% of Enterprise Server instances were still running vulnerable versions.

The good news: GitHub's investigation found no evidence of real-world exploitation beyond the researchers' own tests, and no customer data was compromised during the disclosure process.

How to Check If Your Business Is Vulnerable

Here's a quick action guide to assess and secure your GitHub environment:

Step 1: Identify which GitHub product you're using.

• Log into your GitHub account or admin dashboard.
• If you're on GitHub.com or GitHub Enterprise Cloud, GitHub has already patched the issue on its end — no action required on your part, though monitoring your repositories for unusual activity is always wise.
• If you're running GitHub Enterprise Server, you need to act immediately.

Step 2: Check your GitHub Enterprise Server version.

• Navigate to your GHES admin console (typically at https://[hostname]/setup/settings).
• Your current version is displayed at the top of the page.
• Compare it against the patched versions listed above.

Step 3: Update immediately if you're on a vulnerable version.

• Follow GitHub's official upgrade documentation for your version branch.
• Prioritize this above routine maintenance — this is a critical, easily exploitable flaw.

Step 4: Audit who has push access to your repositories.

• While patching is the fix, it's a good time to review which users and service accounts have push access. Limit it to only those who genuinely need it.
• Review third-party integrations and CI/CD pipelines that push to your repos.

Step 5: Check your logs for anomalous push activity.

• Look for unusual push option values or unexpected hook executions in your audit logs, particularly around and after March 4, 2026, when the vulnerability was first reported.

The Bigger Lesson for Small Businesses and Developers

This vulnerability illustrates something that goes well beyond GitHub itself. As Wiz put it: "When multiple services written in different languages pass data through a shared internal protocol, the assumptions each service makes about that data become a critical attack surface."

For Yuba City businesses and development teams using any kind of multi-service architecture — whether that's GitHub, internal APIs, or cloud platforms — the takeaway is to audit how user-controlled input flows through internal protocols, especially where security-critical configuration is derived from shared data formats.

It's also worth noting that Wiz found this vulnerability in closed-source code using AI-assisted analysis, a sign that the tools attackers and defenders both use are evolving fast. Staying on top of patches and access controls isn't optional anymore.

If your business runs GitHub Enterprise Server and you're unsure whether you're on a patched version, or if you need help auditing who has access to sensitive internal repositories, we're here at Computer Works to help you work through it — that's exactly the kind of IT oversight that prevents small issues from becoming expensive ones.

The fix exists. The vulnerability is easy to exploit. Update now.