Unspecified location – October 19, 2026 -- Wiz Research found a critical vulnerability, CVE-2026-3854, that let any authenticated user execute arbitrary commands on GitHub's backend servers with a single git push command, and 88% of GitHub Enterprise Server instances remained vulnerable at the time of disclosure.
Wiz Research uncovered the flaw on 20 April 2026 in GitHub's internal git infrastructure. It affects both GitHub.com and GitHub Enterprise Server (GHES). The exploit requires only a standard git client.
GitHub.com is fully mitigated; GHES versions up to 3.19.1 stay exposed
GitHub has fully mitigated the issue on GitHub.com, and users there need to take no action. GHES versions up to and including 3.19.1 are vulnerable.
Fixed versions are 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3. GitHub released patches for all supported GHES versions, and administrators are urged to upgrade immediately.
Unsanitized semicolons in the X-Stat header open the injection path
The X-Stat header links internal pipeline components. It carries security-critical fields as semicolon-delimited key=value pairs. Internal services split the header on semicolons and fill a map with last-write-wins semantics, so a repeated key silently overrides the earlier value.
The component babeld copies git push option values directly into the X-Stat header without sanitizing semicolons. A semicolon in a push option value therefore breaks out of its designated field and creates new, attacker-controlled fields.
Three chained injections turn a push option into arbitrary execution
The attack chains three injections:
- Sandbox bypass: injecting a non-production rails_env value switches execution from the sandboxed production path to the unsandboxed path.
- Hook directory redirect: injecting custom_hooks_dir controls the base directory where the binary looks up hook scripts.
- Path traversal: injecting repo_pre_receive_hooks with a crafted hook entry whose script field contains a path traversal sequence resolves to an arbitrary binary on the filesystem.
Shared storage nodes exposed millions of repositories on GitHub.com
On GitHub.com, the flaw allowed remote code execution on shared storage nodes. Millions of public and private repositories belonging to other users and organizations were accessible on the affected nodes.
On GHES, the same flaw grants full server compromise, including access to all hosted repositories and internal secrets.
Wiz flags design patterns that recur across multi-service architectures
Wiz points to three patterns behind the flaw: non-production code paths in production binaries, missing path traversal validation on hook scripts, and delimiter-based protocols that lack input sanitization. Teams building multi-service architectures should audit how user-controlled input flows through internal protocols, especially where security-critical configuration derives from shared data formats.