hypeorhack
← back

CVE-2026-3854

HIGH · 8.8 EPSS 0.3%
hype MIXED · 42 hack

Vendor patching urgent but no KEV listing, PoC, or confirmed exploitation signal.

What: Improper neutralization of special elements in GitHub Enterprise Server git push options allows authenticated attackers to achieve remote code execution via header injection. CVSS 8.8 HIGH.

Why it matters: GitHub patched across six versions (3.14.25 through 3.19.4) within ~3 weeks of disclosure. Vendor statement indicates no in-the-wild exploitation detected pre-patch. Not KEV-listed. Social chatter amplifies severity but confirms vendor response; no public PoC or active exploitation reported.

Where it's seen: Blog posts from security firms (Wiz), industry newsletters, and threat-tracking accounts recycling vendor advisory. Posts emphasize RCE impact and patch urgency; no defender triage questions or PoC drops observed.

RISK: HIGH — Requires push access; rapid patching completed; no active exploitation confirmed.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 5/2/2026, 12:14:26 AM

AttackerKB

view on attackerkb.com →

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.

Public PoCs on GitHub 15 repos

Page 1 of 3

Articles & coverage 15 articles

  • CVE-2026-3854 - Vulnerability Details - OpenCVE

    An improper neutralization of special elements vulnerability in GitHub Enterprise Server lets attackers with push access to a repository cause remote code execution by injecting malicious metadata fields during a git push. The attack vector is likely local to the server through legitimate git push operations, and an attacker must have push access to the target repository to exploit the flaw. | Git

  • GitHub RCE Vulnerability (CVE-2026-3854)

    # GitHub RCE Vulnerability (CVE-2026-3854). A recently disclosed vulnerability (CVE-2026-3854) affects GitHub.com and GitHub Enterprise Server and may allow unauthenticated attackers to achieve remote code execution (RCE)on GitHub Infrastructure. CVE‑2026‑3854 is a sever security vulnerability caused by improper sanitization of user‑supplied git push options within GitHub’s internal Git processing

  • GitHub RCE Vulnerability: CVE-2026-3854 Breakdown - Wiz

    # Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854). Wiz Research uncovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure that could have affected both GitHub.com and GitHub Enterprise Server. By exploiting an injection flaw in GitHub's internal protocol, any authenticated user could execute ar

  • GitHub Enterprise Server RCE (CVE-2026-3854)

    Cyber-themed illustration of a push injection attack against GitHub Enterprise Server repositories, symbolizing a Remote Code Execution (RCE) flaw. # Remote Code Execution in GitHub Enterprise Server via Git Push Injection (CVE-2026-3854). A critical vulnerability (CVE-2026-3854, CVSS 8.7) was disclosed affecting GitHub Enterprise Server and GitHub.com, allowing attackers to execute arbitrary comm

  • GitHub vulnerability CVE-2026-3854 allows code execution with a single git push | brief | SC Media

    # GitHub vulnerability CVE-2026-3854 allows code execution with a single git push. A high-severity vulnerability, identified as CVE-2026-3854, has been discovered in GitHub that enables remote code execution through a basic git push operation. The vulnerability stems from a command injection issue, allowing an attacker with repository push access to execute arbitrary commands on vulnerable systems

Page 1 of 3
› NVD details 1 CWE ·1 vendor · 7 refs expand

Description

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.

Weaknesses

Vendors

  • github

Products

  • enterprise_server

References

Other · 7

Top posts driving the trend