CVE-2026-3854
CWE-77Published: March 10, 2026· Updated: Mar 12, 2026
Official Description
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.
Technical Analysis
CVE-2026-3854 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
News & Research Mentioning CVE-2026-3854
In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. [...] [xlite_meta score:58 src:BleepingComputer xlite_fp:b0ed52d4aecd72936299a7586ddc6387502ab304d3ed752098f87a1b5beb9e7a]
The remote code execution flaw CVE-2026-3854 was found to impact GitHub.com and GitHub Enterprise Server. The post Critical GitHub Vulnerability Exposed Millions of Repositories appeared first on SecurityWeek. [xlite_meta score:53 src:SecurityWeek xlite_fp:7738294c74a50d3433c0018d78ea8fe7d71aea8468154d71767a95a5a9e87e68]
Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command. The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve [xlite_meta score:56 src:The Hacker News xlite_fp:6ad050a5d55a7c07a83855d2b73bb7f41ee84586675368299b393b39466820d8]
All References (6)
Quick Facts
Known Threat Actors
Related CVEs (CWE-77)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-3854 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts