TLDR Tech / InfoSec
Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)
CVE-2026-3854 (CVSS 8.7) is an X-Stat header injection flaw in GitHub's internal git pipeline, where babeld embedded git push option values without sanitizing semicolons, letting any authenticated user override security fields via last-write-wins parsing on a single git push. Chaining injections of rails_env, custom_hooks_dir, and repo_pre_receive_hooks bypassed the sandboxed pre-receive path and triggered path traversal, allowing execution of arbitrary binaries as the git service user, resulting in RCE on shared GitHub.com storage nodes hosting millions of cross-tenant repositories and full compromise of GHES <=3.19.1. GitHub patched GitHub.com within 6 hours. GHES admins must upgrade to 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, or 3.19.3 immediately, since 88% of instances remain vulnerable.
Read the full story