CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive

CVE-2026-3854 is a high-severity vulnerability in GitHub Enterprise Server's push pipeline where user-controlled semicolons in git push options were parsed into internal X-Stat metadata, allowing attackers with repository push access to override execution-related fields and cause pre-receive hooks to execute outside the expected sandbox as the git service user; GitHub and researchers validated impact on GHES and GitHub.com and published patches — administrators should upgrade and inspect historical push logs for suspicious push-option values.