Cybersecurity researchers have disclosed a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command. The flaw, tracked as CVE-2026-3854, is one of the most severe platform-level vulnerabilities GitHub has ever faced. Not a misconfigured workflow, not a leaked token. A bug buried inside the infrastructure that processes every single push operation on the planet's largest code host.
The vulnerability was discovered by Wiz researchers through AI-augmented reverse engineering of closed-source compiled binaries, which is itself a notable shift in how security research gets done. The researchers didn't have source code to work from. They used AI tooling to analyze compiled binaries and still found a flaw that GitHub's own engineers missed.
GitHub is home to hundreds of millions of repositories spanning open source projects, enterprise codebases, and critical infrastructure, and its internal git infrastructure — the pipeline that processes every git push — is one of the most security-sensitive systems on the internet. That context makes this finding land harder than a typical CVE disclosure.
What Is CVE-2026-3854
The flaw is a case of command injection that could allow an attacker with push access to a repository to achieve remote code execution on the instance. Push access is not a high bar. Any user can create their own repository and immediately have push access to it.
The flaw stems from an injection vulnerability in GitHub's internal X-Stat header, a semicolon-delimited protocol that passes security metadata between the platform's internal services. When a user runs git push -o, GitHub's babeld proxy embeds those user-supplied strings directly into the X-Stat header without stripping semicolons.
According to GitHub's own advisory: "During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values."
How the Exploit Chain Works
The attack doesn't stop at header injection. The remote code execution chain strings together three injections: inject a non-production rails_env value to bypass the sandbox, inject custom_hooks_dir to redirect the hook directory, and inject repo_pre_receive_hooks with a crafted hook entry that triggers path traversal to execute arbitrary commands as the git user.
