GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.

Wiz Research uncovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure that could have affected both GitHub.com and GitHub Enterprise Server. By exploiting an injection flaw in GitHub's internal protocol, any authenticated user could execute arbitrary commands on GitHub's backend servers with a single git push command - using nothing but a standard git client. Notably, this is one of the first critical vulnerabilities discovered in closed-source binaries using AI, highlighting a shift in how these flaws are identified. Despite the complexity of the underlying s

saved by

• Justin Wang
• Grace Nguyen
• Devin Plumb
• Kian Kasad

related reading

• Security incident disclosure — July 2026huggingface.co
• Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incidentyoutube.com
• Code Storage by the Pierre Computer Companycode.storage
• Ultralytics AI Library Hacked via GitHub for Cryptomining | Wiz Blogwiz.io
• GitHub - requie/AI-Red-Teaming-Guide: A comprehensive guide to adversarial testing and security evaluation of AI systems, helping organizations identify vulnerabilities before attackers exploit them.github.com
• Hacking OpenAIhacktron.ai
• GitHub - Bin4ry/UniPwn at boschko.cagithub.com
• GitHub - w1b/aisi-mythos-inc-2026-07-28-01-recovered-pr: here's the evil malware Mythos made. idk... i think i could do better bro. shout out codex for slopping this out i didn't write a single line of anythinggithub.com
• Vulnerability Research Is Cooked - Quarrelsomesockpuppet.org
• Why GitHub Actually Won | Butler's Logblog.gitbutler.com
• XZ Utils backdoor - Wikipediaen.wikipedia.org
• Inside GitHub's Fake Star Economy | Awesome Agentsawesomeagents.ai