Git Push to Root: AI-Augmented Research Uncovers Critical GitHub RCE (CVE-2026-3854)

Wiz Research disclosed CVE-2026-3854, a critical RCE in GitHub's internal git infrastructure where unsanitized semicolons in git push options let attackers inject fields into the X-Stat header and escape security controls; researchers achieved code execution on backend servers and access to repositories on multi-tenant storage, GitHub patched the public service quickly but many GHES instances remain vulnerable and must be upgraded.