# GitHub CVE-2026-3854: Remote Code Execution via Single Git Push Command

- **Artifact ID:** CHQ-EX-2026-018
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-018
- **Machine-record SHA-256:** `fc11a8222bee43ca440d7b6866f7743564573e628946a50b15d9556644395ea8`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-018",
  "title": "GitHub CVE-2026-3854: Remote Code Execution via Single Git Push Command",
  "subtitle": "Authenticated user with push access to any repository on a vulnerable GitHub Enterprise Server instance achieved remote code execution on shared backend storage nodes through user-supplied push option values injected into internal protocol headers, demonstrating that authentication acts as the principal gating control on a developer platform whose authentication material is now routinely harvested through supply chain operations.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (MARCH 4 – APRIL 28, 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-03-04",
    "temporal_end": "2026-04-28"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Vulnerability: CVE-2026-3854, CVSS 8.7. Command injection in the GitHub git push pipeline. User-supplied push option values were not sanitized before inclusion in internal X-Stat service headers used between GitHub frontend and backend services. The header delimiter character (semicolon) was injectable by the user.",
        "Exploit Chain: A single git push command containing a crafted push option enabled a three-stage injection. First, the attacker overrode the rails_env value to bypass the production sandbox restrictions on the receiving service. Second, the attacker injected a custom_hooks_dir value to redirect the receive hook directory. Third, the attacker injected a repo_pre_receive_hooks value with path traversal characters to point hook execution at arbitrary commands. The result was remote code execution on backend storage nodes shared across repositories.",
        "Discovery and Disclosure: Wiz Research discovered and reported the vulnerability to GitHub on March 4, 2026. GitHub.com production was patched within two hours of report. GitHub Enterprise Server received patches in versions 3.14.25 through 3.20.0, released March 10, 2026. CVE-2026-3854 was assigned. Public disclosure occurred April 28, 2026.",
        "Authorization Boundary: Push access to any repository was the only prerequisite. The attacker did not need to be a maintainer, an admin, or have any elevated privileges. A single forked repository with a single accepted pull request would be sufficient on most public projects.",
        "Backend Scope: The shared storage architecture meant that successful exploitation provided code execution context with read access to repositories beyond those the authenticating user had push access to. Wiz characterized the cross-tenant blast radius as covering millions of public and private repositories on affected shared storage nodes.",
        "Exploitation in Wild: GitHub forensic telemetry confirmed no triggering of the anomalous code path outside Wiz’s authorized testing window. No in-wild exploitation was observed.",
        "GHES Adoption Lag: At the time of public disclosure on April 28, GitHub Enterprise Server installations running pre-patch versions represented approximately 88% of GHES instances based on third-party scanning. Patch adoption between March 10 and April 28 had not closed the exposure window for the GHES population."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The structural significance of this exhibit is the relationship between authentication and exploitability in a developer platform context, rather than the command injection mechanism itself.",
        "The vulnerability required authentication. Authentication is the principal gating control. In most threat models, “authenticated user with push access” is treated as a meaningful access boundary. In a developer platform context in 2026, that boundary is structurally permeable.",
        "Developer authentication material is routinely harvested through supply chain operations. The TeamPCP cascade documented in CHQ-EX-2026-014, the SAP CAP and PyTorch Lightning compromise documented in CHQ-EX-2026-017, and the LiteLLM PyPI compromise documented in CHQ-ED-2026-015 all included GitHub token theft as a primary outcome. By the time CVE-2026-3854 was publicly disclosed on April 28, 2026, the same actor cluster had been harvesting GitHub credentials at industrial scale for over a month.",
        "The “requires authentication” precondition does not function as a meaningful access boundary when the population of valid authentication material has been compromised at scale. The CVE-2026-3854 exposure window for any organization running GHES intersected the credential harvest window of the prior month’s supply chain operations.",
        "The shared storage architecture is the second structural element. Cross-repository read access through hook execution context means that compromise of one user’s push capability extends to repositories the user cannot access through normal GitHub UI or API operations.",
        "The patch adoption lag for GHES is the third element. Eighty-eight percent of GHES instances remained vulnerable at the time of public disclosure, forty-nine days after the fix was available."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-P-2026-013 — Position: Portable Developer Identity Cannot Contain Credential Compromise Across Registries.",
        "CHQ-P-2026-015 — Position: Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute.",
        "CHQ-SM-2026-014 — Memorandum: Publication Authority Inheritance as Structural Attack Surface.",
        "CHQ-SC-2026-006 — Condition: Exploitation Timing Precedes Defender Awareness.",
        "CHQ-ED-2026-018 — Evidence Docket: CHQ-P-2026-015 (Execution Pipelines as Control Planes, successor docket)."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: March 4 – April 28, 2026. Exhibit issuance date is May 4, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: Wiz Research, GitHub Security Blog, The Hacker News, GitHub Advisory Database.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-05-04"
}
```