Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push

Summary: Researchers disclosed CVE-2026-3854, a command injection flaw with a CVSS score of 8.7 in GitHub.com and GitHub Enterprise Server that lets an authenticated user with push access achieve remote code execution through a single git push. GitHub's advisory states that user-supplied push option values were not sanitized before being placed in internal service headers, and because the header format used a semicolon delimiter that could also appear in user input, an attacker could inject additional metadata fields.
What's compelling: Wiz, which reported the issue on March 4, 2026, said about 88% of instances were vulnerable at public disclosure, and GitHub noted that code execution on GitHub.com enabled cross-tenant exposure, allowing an attacker to read millions of repositories on a shared storage node regardless of organization or user.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-3854
Related: ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026