Critical GitHub Vulnerability CVE-2026-3854 Allows Remote Code Execution

A newly identified vulnerability in GitHub could enable remote code execution through a simple git push command.

3 min readSecurity

Cybersecurity experts have revealed a significant security issue affecting both GitHub.com and GitHub Enterprise Server. This vulnerability, designated CVE-2026-3854, has a CVSS score of 8.7, indicating its severity. The flaw arises from a command injection vulnerability that permits an authenticated user with push privileges to execute arbitrary code remotely. This means that if an attacker gains access to a repository, they could potentially run malicious code on the server with just a single command. The implications of this vulnerability are serious, as it could compromise the integrity of the affected systems and lead to unauthorized access or data breaches. GitHub has been alerted to the issue and is expected to take steps to mitigate the risk. Users are advised to remain vigilant and ensure their repositories are secure, particularly those with multiple contributors.

Security