What’s Vulnerable › Vulnerabilities

CVE-2026-3854: Remote code execution via git push option injection in GitHub Enterprise Server

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 39.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-77

Description

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.

Affected products

• GitHub Enterprise Server: before 3.14.24; from 3.15.0 before 3.15.19; from 3.16.0 before 3.16.15; from 3.17.0 before 3.17.12; from 3.18.0 before 3.18.6; from 3.19.0 before 3.19.3 — fixed in 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, 3.19.3

How to fix

Upgrade to a fixed version: GitHub Enterprise Server 3.14.24, 3.15.19, 3.16.15, 3.17.12. Check the vendor advisory for mitigations.

References

• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4
• https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Get alerted when CVE-2026-3854 or the next vulnerability affects your stack