Full Report
Details on CVE-2026-3854: A critical flaw in GitHub’s internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server.
Analysis Summary
# Vulnerability: Critical RCE in GitHub Infrastructure via Internal Protocol Injection
## CVE Details
- **CVE ID**: CVE-2026-3854
- **CVSS Score**: 10.0 (Critical)
- **CWE**: CWE-20 (Improper Input Validation) / CWE-94 (Improper Control of Generation of Code - Injection)
## Affected Systems
- **Products**: GitHub Enterprise Server (GHES) and GitHub.com
- **Versions**:
- GHES versions < 3.19.3 (Specifically 3.16.x, 3.17.x, 3.18.x, and 3.19.x)
- **Configurations**: Authenticated user access (any user capable of performing a `git push`).
## Vulnerability Description
The flaw resides in GitHub’s internal binary protocol, specifically in a service responsible for handling Git push operations. When a user pushes code, the Git client communicates with a proxy that translates the request into an internal protocol. This protocol utilizes an `X-Stat` header containing semicolon-separated key-value pairs (e.g., `key1=val1;key2=val2`).
The proxy failed to sanitize input used in the `ref` (branch name) field. By pushing to a specially crafted branch name containing a semicolon and newline characters, an attacker could inject arbitrary key-value pairs into the `X-Stat` header. Specifically, researchers injected:
1. **`custom_hooks_path`**: Redirecting the server to execute a script controlled by the attacker.
2. **`user_operator_mode`**: Forcing the server into an "enterprise mode" on GitHub.com to enable the execution of these custom hooks.
## Exploitation
- **Status**: PoC demonstrated by Wiz Research; mitigated by vendor.
- **Complexity**: Medium (Requires understanding of GitHub's internal binary protocol and reverse engineering of backend binaries).
- **Attack Vector**: Network (Authenticated `git push`).
## Impact
- **Confidentiality**: **High** - Access to all private repositories, internal secrets, and sensitive configuration data.
- **Integrity**: **High** - Ability to modify any repository on the affected storage node or server.
- **Availability**: **High** - Full control over the Git service user, enabling system-wide disruption.
## Remediation
### Patches
GitHub has released the following fixed versions for Enterprise customers:
- **GitHub Enterprise Server 3.19.3**
- **GitHub Enterprise Server 3.18.5**
- **GitHub Enterprise Server 3.17.9**
- **GitHub Enterprise Server 3.16.14**
### Workarounds
No practical workarounds are provided other than updating the software. GitHub.com has already been patched by the vendor.
## Detection
- **Indicators of Compromise**: Monitor for `git push` commands targeting suspicious branch names containing characters such as `;`, `\n`, or keywords like `custom_hooks_path`.
- **Detection methods and tools**: Review GHES audit logs for unauthorized configuration changes or unusual execution of hooks from non-standard paths.
## References
- **Vendor Advisory**: [https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/](https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/)
- **Wiz Research Blog**: [https://www.wiz.io/blog/securing-github-wiz-research-uncovers-remote-code-execution-in-github](https://www.wiz.io/blog/securing-github-wiz-research-uncovers-remote-code-execution-in-github)