Wiz Research has identified a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-3854, deeply embedded within GitHub’s internal git infrastructure.
This high-severity flaw enabled any authenticated user to execute arbitrary commands on backend servers using a single standard git push command.
The vulnerability originates from an improper neutralization of special elements during repository push operations.
GitHub’s internal architecture uses multiple services to process a git push, passing security-critical configuration metadata via an internal header named X-Stat.
The primary entry service, babeld, copied user-controlled git push options directly into this internal header without sanitizing semicolon characters.
Because the X-Stat header uses semicolons as field delimiters, attackers could inject their own metadata fields by simply including semicolons in their push options, as reported by Wiz.
GitHub.com and Enterprise Server Vulnerability
The internal header parsing mechanism follows a last-write-wins policy, meaning that fields inserted later in the string silently override legitimate security policies set by the authentication service.
| Component | Vulnerable Versions | Fixed Versions |
|---|---|---|
| GitHub Enterprise Server | 3.19.1 and older | 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 |
Attackers successfully leveraged this delimiter injection to override security flags and compromise the system.
The escalation to full remote code execution required chaining three specific field injections:
- Attackers injected a non-production rails_env value to bypass the security sandbox and run custom pre-receive hooks directly.
- They injected a malicious custom_hooks_dir value to redirect the base directory where the server looks for hook scripts.
- They supplied a crafted repo_pre_receive_hooks definition containing a path traversal sequence to target arbitrary binaries on the filesystem.
Once executed, the unsandboxed code ran under the privileges of the internal git service user.
On GitHub Enterprise Server (GHES), this flaw resulted in complete server compromise, granting unauthorized access to all hosted repositories, internal configuration data, and system secrets.
On GitHub.com, the multi-tenant architecture amplified the risk. Successful exploitation enabled attackers to obtain broad filesystem access to shared storage nodes running as the git service user.
This level of access meant threat actors could theoretically read millions of public and private repositories belonging to entirely different organizations and users sharing that node.
Extracting and analyzing the vast number of compiled blackbox binaries governing GitHub’s multi-service architecture manually is highly impractical.
Wiz researchers successfully used AI-augmented automated reverse-engineering tools, specifically IDA MCP, to systematically reconstruct internal communication protocols.
This highlights a significant industry shift toward using AI capabilities to uncover complex, cross-component vulnerabilities in closed-source platforms.
GitHub mitigated the vulnerability on GitHub.com within six hours of the initial report. In self-hosted environments, immediate patching is required, as the attack is network-based and requires only push access to a single repository.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 vulnerability, tracked as CVE-2026-3854, deeply embedded within GitHub's internal git infrastructure.){kind=link}