Strengthening Git Push Pipeline Security: Response to a Critical Remote Code Execution Vulnerability

On March 4, 2026, GitHub confirmed a critical Remote Code Execution (RCE) vulnerability affecting github.com, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, GitHub Enterprise Cloud with Enterprise Managed Users, and GitHub Enterprise Server (GHES), based on a bug bounty report from Wiz. Internal verification was completed within 40 minutes, and the root cause was confirmed the same day at 5:45 p.m. UTC, with a patch deployed to github.com at 7:00 p.m. UTC. github.com and the cloud products are already patched and require no separate action.

The vulnerability arose because the value of a push option in git push was inserted into internal metadata without sufficient sanitization. Using only a single git push with a crafted push option, an attacker could exploit the delimiter to inject additional fields, and when a downstream service interpreted this as a trusted internal value, it could bypass sandbox protections and lead to arbitrary command execution on the server.

The investigation found that all executions of this abnormal code path were confirmed to be from Wiz's testing only, with no trace from any other user or account. There was no access, modification, or exfiltration of customer data. Since this path was code originally used only in a different product configuration that had remained inside the container image, GitHub strengthened its defenses by removing the unnecessary path in addition to input sanitization.

GHES customers were assigned CVE-2026-3854 and must upgrade to the following releases or later:

• 3.14.25
• 3.15.20
• 3.16.16
• 3.17.13
• 3.18.7
• 3.19.4
• 3.20.0

On GHES, only authenticated users with push permissions could exploit this, so operators are advised to check /var/log/github-audit.log for operations with push options containing ;.