CVE-2026-3854

CVE-2026-3854 is an improper neutralization flaw (CWE-77) in GitHub Enterprise Server in which user-supplied git push option values are placed into internal service headers without sanitization. An authenticated user with push access to any repository can trigger it with a single crafted git push, injecting additional metadata fields through the delimiter character used in the internal header format. Successful injection yields remote code execution on the GHES instance, giving the attacker control of the server and the code repositories it hosts. All self-hosted GHES deployments running affected builds in the 3.14 through 3.19 branches are affected; fixes are available in 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 40% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days, and the flaw is not yet in CISA's KEV catalog.

What to do: Upgrade GitHub Enterprise Server to 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 or 3.19.4 (or later in each branch) as a priority, given the 40% EPSS likelihood of near-term exploitation. If patching must wait, review and restrict push-access grants to trusted users and consider disabling git push options (receive.advertisePushOptions=false) since they are the injection vector. Check GHES upgrade and push-related logs for anomalous activity from accounts with push access.