GitHub issues $100,000 bounty for critical RCE vulnerability disclosed by @sagitz_

2026-07-28

GitHub paid researcher @sagitz_ a $100,000 bounty, reportedly among the largest in its Vulnerability Reward Program, for CVE-2026-3854, an unauthenticated remote code execution flaw in the handling of crafted repository URLs.