GitHub Patched Critical `git push` RCE Affecting Cloud and Enterprise Server

GitHub disclosed and patched CVE-2026-3854, a critical command-injection flaw in its git push pipeline that allowed an authenticated user with repository push access to trigger remote code execution using a single crafted push. Wiz reported the bug on March 4, and GitHub said it reproduced the issue within about 40 minutes and deployed a fix to GitHub.com within roughly two hours, later publishing patches for supported GitHub Enterprise Server releases including 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3. The vulnerability stemmed from unsanitized user-supplied push option values being inserted into internal X-Stat headers, enabling attackers to inject trusted metadata, bypass sandboxing, and execute commands as the git service user.

Researchers said the flaw could have led to full server compromise on GitHub Enterprise Server and, on GitHub.com, code execution on shared storage infrastructure where millions of repositories were accessible to the git service account, creating potential cross-tenant exposure. GitHub said forensic analysis and telemetry found no evidence of malicious exploitation and no indication that customer data was accessed, modified, or exfiltrated, but urged Enterprise Server administrators to upgrade immediately and review logs for suspicious push activity. Wiz described the bug as easy to exploit and highlighted its use of AI-assisted reverse engineering tools, including IDA MCP, to uncover the issue in GitHub’s closed-source components.