Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push

Summary

Researchers have identified a critical remote code execution (RCE) vulnerability in GitHub.com and GitHub Enterprise Server, identified as CVE-2026-3854. This flaw can be exploited by an authenticated user with push access to a repository through a single 'git push' command, enabling attackers to execute arbitrary code.

IFF Assessment

FOE

This vulnerability allows for remote code execution, which is a severe threat to system integrity and data security.

Severity

8.8 High

The CVSS score of 8.7 indicates a critical severity, driven by the potential for remote code execution through a simple command injection attack on a widely used platform.

Defender Context

This critical RCE vulnerability in GitHub requires immediate attention from security teams managing GitHub instances. Defenders should prioritize patching or applying mitigations as soon as they become available to prevent unauthorized code execution and potential repository compromise.

Read Full Story →