GitHub Enterprise Server: code execution via git push (CVE-2026-3854)

Code execution on GitHub Enterprise Server by users with push access, CVSS 8.8. Update to the fixed release for your branch.

On 10 March 2026 the record for CVE-2026-3854 was published: a vulnerability that allows a user with push access to a repository to achieve code execution on the GitHub Enterprise Server instance. The NVD score is CVSS v3.1 8.8 (high). The report came through GitHub's bug bounty programme.

The cause is insufficient neutralisation of git push option values, which were placed in internal headers using a delimiter that could also appear in user input. It is an injection issue (CWE-77) and concerns only users who already have push access.

Update to the fixed release for your branch. If updating is not immediate, restrict push access to repositories and review accounts with write privileges.

At a glance

What: Code execution on the GitHub Enterprise Server instance by a user with push access to a repository.
Severity: CVSS v3.1 8.8 (high), according to NVD. CVSS v4.0 8.7 according to GitHub.
Cause: Values of git push options were not neutralised before being placed in internal headers (CWE-77).
Fix: GHES 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.
Action: Update the instance to the fixed release for your branch and review who has push access to repositories.

Sources: NVD, CVE-2026-3854 · Wiz, analisi della vulnerabilità · GitHub, note di rilascio GHES 3.19.4

← All articles