GitHub Push Metadata Injection Enables Remote Code Execution in CVE-2026

A high-severity vulnerability in GitHub Enterprise Server’s Git push pipeline, CVE-2026-3854 , allows an authenticated user with repository push access to execute commands as the git service user outside the normal pre-receive hook sandbox. Rated 8.7 under CVSS 4.0 , the flaw lets attackers inject semicolon-delimited fields into internal X-Stat metadata through push options. Last-write-wins parsing allows those fields to override trusted hook-processing configuration, potentially exposing repository data, configuration, and secrets beyond the attacker’s authorized repository.

Wiz reported that GitHub.com shared the underlying vulnerability, creating potential cross-tenant exposure; GitHub stated that researchers did not access other users’ repository contents. GitHub has identified patched Enterprise Server releases, and administrators should prioritize upgrading affected installations. Security teams should review historical push options containing semicolons for suspicious activity, preserve relevant evidence, investigate potential repository or credential exposure, and rotate potentially exposed secrets where warranted.

See affected versions and whether adversaries are exploiting it.

How this story unfolded

3 events from the most recent confirmed update back to the earliest known activity.

GitHub identifies patched GHES builds and provides audit guidance

GitHub identified GHES 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, and 3.20.0 as the minimum patched builds for their respective release branches. It recommended reviewing /var/log/github-audit.log for push options containing semicolons and investigating suspicious activity rather than treating every match as proof of exploitation.

GitHub clarifies the scope of researchers' repository access

GitHub stated that researchers accessed repository records to validate the vulnerability but did not access other users' repository contents.

Wiz publishes research on CVE-2026-3854 affecting GHES and GitHub.com

Wiz reported that the vulnerability affected both GitHub Enterprise Server and GitHub.com, creating potential cross-tenant exposure. An authenticated user with repository push access could inject internal metadata through Git push options, override hook-processing settings, and execute commands outside the normal sandbox as the git service user.

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

2 references tracked. Mallory keeps watching after this page renders.

CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive - Malware News - Malware Analysis, News and Indicators

CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | Seqrite

See the full picture, correlated to your attack surface.

Map indicators from this story to your assets and identify affected systems in minutes.

Every observed campaign, victim, and pivot linked to actors named in this story.

Malware, exploits, and IOCs connected to the activity described here.

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Get matching new stories delivered to your team as they break — not the morning.

Ask questions this story and take action on the answers.