CVE-2026-3854

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14.25 GitHub Enterprise Server versions prior to 3.15.20 GitHub Enterprise Server versions prior to 3.16.16 GitHub Enterprise Server versions prior to 3.17.13 GitHub Enterprise Server versions prior to 3.18.8 GitHub Enterprise Server versions prior to 3.19.4 GitHub Enterprise Server versions prior to 3.20.0

Description An improper neutralization of special elements allows an authenticated attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values are not properly sanitized before being included in internal service headers. Specifically, the babeld proxy embeds these options into the X-Stat header without sanitizing semicolons (;), which are used as delimiter characters. This allows an attacker to inject and override internal metadata fields such as rails env, custom hooks dir, and repo pre receive hooks to bypass sandboxing and execute arbitrary commands via pre-receive hooks as the git service user.

On GitHub Enterprise Server, this can lead to full server compromise, including access to all hosted repositories and internal secrets. On the cloud platform, the issue allowed remote code execution on shared storage nodes, potentially exposing millions of public and private repositories through cross-tenant exposure. It is estimated that approximately 88% of reachable GitHub Enterprise Server instances remained unpatched at the time of public disclosure. No evidence of real-world exploitation was found prior to the patch.

Recommendations Upgrade GitHub Enterprise Server to version 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, 3.20.0 or newer. As a temporary workaround, avoid running git push operations, especially those using the -o flag or custom push options, until the system is upgraded.