GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

What it is

CVE-2026-3854 (CVSS 8.7), the GitHub git-push-pipeline RCE that Wiz Research disclosed. The existing summary covers the root cause (semicolon injection into the internal X-Stat header via git push -o, chained through rails_env/custom_hooks_dir/repo_pre_receive_hooks to escape the custom-hooks sandbox). What follows is the actionable material the summary omits: the version boundary, the extra step needed on GitHub.com, and the current exposure.

How it works (the GitHub.com twist)

The summary's chain gave RCE on GHES because enterprise mode defaults the custom-hooks path to active. On GitHub.com that path is never reached by default — the first attempts pushed successfully but ran nothing. Wiz found a boolean enterprise-mode flag also carried in X-Stat, which defaults to false on GitHub.com. Because it travels through the same header, it's injectable via the same mechanism; one more injected field enabled the full chain there. They surfaced this by injecting user_operator_mode=bool:true to turn on debug output and diffing GHES vs. GitHub.com behaviour.

Preconditions / Affected

• Any authenticated user with push access, standard git client, single git push.
• GHES: vulnerable through 3.19.1 (RCE confirmed on that build); full server compromise — all hosted repos and internal secrets.
• GitHub.com: already mitigated by GitHub; no user action required.

What to do

GHES administrators, upgrade immediately:

Upgrade to GHES version 3.19.3 or later

3.19.3 is the release that patches CVE-2026-3854. Wiz customers can find vulnerable instances via a pre-built query in the Wiz Threat Center.

Caveats

• Exposure is not hypothetical: at time of writing, Wiz data indicates 88% of GHES instances are still vulnerable — treat unpatched GHES as actively exploitable, since the exploit is described as "remarkably easy" despite the complex chain.
• Wiz states they did not read other tenants' repository contents; cross-tenant exposure on GitHub.com's shared storage nodes (millions of repo index entries per node, readable as the shared git user) was validated only against their own test accounts based on filesystem permissions.
• Timeline is fast and worth noting for patch urgency: reported and fixed on GitHub.com the same day (2026-03-04, within ~6 hours); CVE assigned and GHES patch released 2026-03-10; public disclosure 2026-04-28.

The generalizable lesson Wiz draws: in multi-service architectures where components share a delimiter-based internal protocol, audit how user-controlled input flows across trust boundaries — one service trusted push options verbatim, another trusted every X-Stat field as authoritative, and a production binary retained a non-production (unsandboxed) code path.