CVE-2026-3854

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14.25 GitHub Enterprise Server versions prior to 3.15.20 GitHub Enterprise Server versions prior to 3.16.16 GitHub Enterprise Server versions prior to 3.17.13 GitHub Enterprise Server versions prior to 3.18.8 GitHub Enterprise Server versions prior to 3.19.4 GitHub Enterprise Server versions prior to 3.20.0

Description An improper neutralization of special elements allows an authenticated attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values are not properly sanitized before being included in internal service headers. Because the internal header format uses a delimiter character (semicolon) that can also appear in user input, an attacker can inject additional metadata fields.

Technical exploitation involves injecting values into the X-Stat header to override internal fields such as rails env, custom hooks dir, and repo pre receive hooks. By setting rails env to a non-production value, an attacker can bypass sandboxing and use repo pre receive hooks to execute arbitrary binaries, such as /bin/bash, as the git service user. On GitHub Enterprise Server, this can lead to full server compromise, including access to all hosted repositories and internal secrets. On shared infrastructure, it could allow cross-tenant exposure to millions of private repositories. It is estimated that approximately 88% of reachable GitHub Enterprise Server instances remained unpatched at the time of public disclosure.

Recommendations Update GitHub Enterprise Server to version 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, or 3.20.0. As a temporary workaround, avoid using the git push -o command with custom push options until the system is upgraded.