CVE-2026-3854
highpriority · attend · 59EPSS 0.398 · 99 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (7)
Public proof-of-concept and weaponised exploit code.
- 5kr1pt/CVE-2026-38545kr1pt/CVE-2026-3854PoC · poc_in_github
- LACHHAB-Anas/Exploit_CVE-2026-3854Details about CVE-2026-3854PoC · poc_in_github
- lysophavin18/CVE-2026-3854-PoCGitHub RCE via X-Stat Push Option InjectionPoC · poc_in_github
- royaleybovich/CVE-2026-3854-labroyaleybovich/CVE-2026-3854-labPoC · poc_in_github
affected products (30)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0685Microsoft GitHub Enterprise Server: Mehrere SchwachstellenDeutsch2026-03-10csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Dateien zu manipulieren und um beliebigen Code auszuführen.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (21)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-3854cnnvd
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24cnnvd
- https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19cnnvd
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15cnnvd
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12cnnvd
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6cnnvd
- https://docs.github.com/en/enterprise-server@3.19/admin/all-releasesPatchcnnvd
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan