Reported by 3 outlets

Timeline

1. original reporting

   GitHub Pays $100,000 Bounty for Critical RCE Flaw Triggered by a Single Git Push

   cyberpress.org · 29d ago · September 14th, 2026

   GitHub has reportedly awarded a $100,000 bug bounty to security researcher Saif Ghani for identifying a critical remote code execution vulnerability that could be triggered through a specially crafted Git repository operation. The flaw, tracked as CVE-2026-3854, was disclosed publicly on July 22 after GitHub remediated the issue through its coordinated vulnerability disclosure process. The reported vulnerability affected GitHub’s handling of crafted repository URLs or Git push-related input. An attacker could allegedly abuse the vulnerable processing path to execute arbitrary commands on GitHub backend infrastructure without prior authentication. GitHub Pays $100,000 Bounty for Critical RCE Flaw Remote code execution vulnerabilities are among the highest-impact bugs for source-code hosting platforms because a successful exploit can move beyond a single repository or user account. If attackers obtain command execution within a platform’s backend environment, they may attempt to access internal services, manipulate source-code delivery workflows, retrieve sensitive credentials, or interfere with build and deployment pipelines. RuntimeWire said the proof of concept resulted in shell access on an affected server environment. From there, researchers showed the potential to read repository secrets and alter code while the service handled it. That scenario creates a particularly serious software supply-chain concern. Compromising a central development platform could allow threat act

2. update from bleepingcomputer.com

   GitHub RCE (CVE-2026-3854) could have exposed millions of private repositories

   bleepingcomputer.com · 168d ago · April 29th, 2026

   A critical remote code execution vulnerability in GitHub's git push pipeline could have granted attackers full read/write access to private repositories with as little as a single crafted git push command. The flaw exists in how GitHub handles user-supplied options during push operations — values were incorporated into internal server metadata without sufficient sanitization, allowing injection of additional trusted fields that bypass sandboxing protections. Affects GitHub.com, GitHub Enterprise Cloud (including Data Residency and Managed Users), and GitHub Enterprise Server. GitHub reproduced the vulnerability within 40 minutes of Wiz's March 4 report and deployed a fix in under two hours, but any Enterprise Server instances that haven't applied the patch remain vulnerable.

3. update from malware.news

   CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive

   malware.news · 7d ago · October 6th, 2026

   CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. For organizations that use GHES to host private source code, deployment credentials, and connections to internal development systems, the issue shows why metadata crossing from a client-controlled protocol into privileged server-side processing must be treated as untrusted at every stage. Downstream services interpreted those fields as server-generated configuration. By overriding values that governed hook processing, an attacker could move pre-receive hook execution outside the expected sandbox and run commands as the git service user. The vulnerability received a CVSS 4.