Wiz Finds GitHub Flaw Letting One git push Run Code on Servers
Unspecified location – October 19, 2026 -- Wiz Research found a critical vulnerability, CVE-2026-3854, that let any authenticated user execute arbitrary commands on GitHub's backend servers with a single git push command, and 88% of GitHub Enterprise Server instances remained vulnerable at the time of disclosure.
Wiz Research uncovered the flaw on 20 April 2026 in GitHub's internal git infrastructure. It affects both GitHub.com and GitHub Enterprise Server (GHES). The exploit requires only a standard git client.
GitHub.com is fully mitigated; GHES versions up to 3.19.1 stay exposed
GitHub has fully mitigated the issue on GitHub.com, and users there need to take no action. GHES versions up to and including 3.19.1 are vulnerable.
Fixed versions are 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3. GitHub released patches for all supported GHES versions, and administrators are urged to upgrade immediately.