PT-2026-24344 · Github · Github Enterprise Server

Sagi Tzadik · CVE-2026-3854 · Published 2026-03-04 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14.25 GitHub Enterprise Server versions prior to 3.15.20 GitHub Enterprise Server versions prior to 3.16.16 GitHub Enterprise Server versions prior to 3.17.13 GitHub Enterprise Server versions prior to 3.18.8 GitHub Enterprise Server versions prior to 3.19.4 GitHub Enterprise Server versions prior to 3.20.0

Description An improper neutralization of special elements allows an authenticated attacker with push access to a repository to achieve remote code execution (RCE) on the instance. During a git push operation, user-supplied push option values are not properly sanitized before being included in internal service headers. Because the internal header format uses a delimiter character (semicolon) that can also appear in user input, an attacker can inject additional metadata fields.

Technical exploitation involves a chain of injections within the X-Stat header to bypass sandboxing and execute arbitrary code via pre-receive hooks. Specifically, attackers can manipulate variables such as rails env to escape the sandbox, custom hooks dir to control hook resolution, and repo pre receive hooks to execute binaries like /bin/bash. On GitHub Enterprise Server, this can lead to full server compromise, including access to all hosted repositories and internal secrets. On shared infrastructure, it could allow cross-tenant exposure to millions of private repositories. It is estimated that approximately 88% of reachable GitHub Enterprise Server instances remained unpatched at the time of public disclosure.

Recommendations Upgrade GitHub Enterprise Server to version 3.14.25 or newer. Upgrade GitHub Enterprise Server to version 3.15.20 or newer. Upgrade GitHub Enterprise Server to version 3.16.16 or newer. Upgrade GitHub Enterprise Server to version 3.17.13 or newer. Upgrade GitHub Enterprise Server to version 3.18.8 or newer. Upgrade GitHub Enterprise Server to version 3.19.4 or newer. Upgrade GitHub Enterprise Server to version 3.20.0 or newer. As a temporary mitigation, avoid using git push with custom push options (the -o flag) until the system is upgraded.

Fix

LPE

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2026-06062

CVE-2026-3854

Affected Products

Github Enterprise Server

References · 294

• https://bdu.fstec.ru/vul/2026-06062 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3854 · Security Note
• https://twitter.com/lyrie_ai/status/2060258913346294057 · Twitter Post
• https://twitter.com/Dhanush_Nehru/status/2049201636208460071 · Twitter Post
• https://twitter.com/KisekiyaCodes/status/2049184407282647297 · Twitter Post
• https://twitter.com/Soemailsecurity/status/2049561792876097745 · Twitter Post
• https://twitter.com/grok/status/2049190777838780691 · Twitter Post
• https://twitter.com/YeethSecurity/status/2049544161531928761 · Twitter Post
• https://twitter.com/vivek_sing67273/status/2049529122825867600 · Twitter Post
• https://twitter.com/exortresearch/status/2057021227903135748 · Twitter Post
• https://twitter.com/Bild96/status/2054347846334419212 · Twitter Post
• https://twitter.com/AISGateway/status/2049461379371880652 · Twitter Post
• https://twitter.com/lyrie_ai/status/2060258912306127180 · Twitter Post
• https://docs.github.com/en/%20enterprise-server@3.17%20/admin/release-notes#3.17.13 · Note