Wiz Details GitHub RCE Flaw Allowing Code Execution With a Single Git Push

Apr 28, 2026 · Original article ↗

Summary

Wiz disclosed CVE-2026-3854, an X-Stat injection flaw that enabled RCE on GitHub.com and GitHub Enterprise Server. GitHub fixed GitHub.com and patched supported GHES versions; Wiz said 88% of instances remained vulnerable at publication.

Key points

An authenticated user could exploit unsanitized semicolons in Git push options to inject fields into GitHub's internal X-Stat header.
On GHES, researchers chained injected fields to bypass hook sandboxing, redirect hook lookup, and execute an arbitrary binary as the git service user.
The same flaw enabled RCE on GitHub[.]com shared storage nodes, where the git user could access repositories belonging to other tenants. Wiz said it validated exposure using test accounts and did not access other tenants' repository contents.
GitHub mitigated the issue on GitHub[.]com and released patches for supported GHES versions, including 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3.
Wiz urged GHES customers to upgrade and reported that 88% of instances were still vulnerable at the time of publication.
The researchers used AI-augmented reverse engineering to analyze compiled binaries and reconstruct the internal protocol.

Article Details

Attack Vectors: An authenticated user could send a crafted git push with push-option values containing semicolons, injecting fields into the X-Stat header.
The injected fields could redirect custom-hook lookup and provide a path-traversal sequence, leading to unsandboxed execution of a binary as the git service user.
On GitHub.com, an additional injected field enabled the custom-hook execution path; Wiz reported confirming code execution on a shared storage node.
Defensive Notes: GitHub mitigated the issue on GitHub.com; the article says no action is required for GitHub.com users.
GitHub Enterprise Server customers should upgrade immediately to version 3.19.3 or later, or to a fixed release for their supported version: 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, or 3.19.3.
Wiz reported that 88% of GHES instances were still vulnerable at the time of writing.
The article recommends auditing how user-controlled input flows through internal protocols, especially where security-critical configuration is derived from shared data formats.