{"id":16152,"date":"2026-04-29T11:51:29","date_gmt":"2026-04-29T11:51:29","guid":{"rendered":"https:\/\/newestek.com\/?p=16152"},"modified":"2026-04-29T11:51:29","modified_gmt":"2026-04-29T11:51:29","slug":"critical-github-rce-bug-exposed-millions-of-repositories","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16152","title":{"rendered":"Critical GitHub RCE bug exposed millions of repositories"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

A critical remote code execution (RCE) vulnerability in GitHub could potentially allow attackers to execute arbitrary code on GitHub.com and GitHub Enterprise Server.<\/p>\n

Uncovered by Wiz researchers, the now-patched bug exploited how GitHub handles server-side \u201cgit push\u201d operations. By crafting malicious input within a standard Git push<\/a>, an authenticated user could execute arbitrary commands via GitHub\u2019s backend Git processing pipeline.<\/p>\n

GitHub acknowledged the severity of the finding, with CISO Alexis Wales<\/a> noting, \u201cA finding of this caliber and severity is rare, earning one of the highest rewards available in our Bug Bounty program.\u201d<\/p>\n

GitHub fixed the issue on GitHub.com and released patches for all supported versions of GitHub Enterprise Server within hours of the report. However, Wiz said that 88% of Enterprise Server instances remained vulnerable on the internet at the time of public disclosure.<\/p>\n

<\/a>GitHub\u2019s faulty processing of git push<\/h2>\n

The flaw, tracked as CVE-2026-3854<\/a>, stemmed from how GitHub processes git push requests within its backend Git infrastructure. According to Wiz, the issue involves an internal component referred to as X-STAT, which sits in the path of GitHub\u2019s server-side handling of Git <\/a>operations.<\/p>\n

Wiz researchers found that a specially crafted git push could pass maliciously structured input into X-STAT, where it was not safely handled before being incorporated into backend command execution. Because this processing happens server-side as part of GitHub\u2019s normal handling of repository events, the input could influence how commands were constructed or executed within that pipeline.<\/p>\n

The flaw received a near-critical CVSS rating of 8.8 out of 10, and was fixed in GitHub Enterprise Server versions 3.14.25 through 3.20.0. The flaw was categorized by GitHub as a \u201ccommand injection\u201d issue, resulting from \u201cimproper neutralization of special elements used in a command.\u201d<\/p>\n

AI was reportedly used in finding this flaw, using the IDA MCP<\/a> (AI-augmented) reverse engineering tooling. \u201cThis is one of the first critical vulnerabilities discovered in closed-source binaries using AI, highlighting a shift in how these flaws are identified,\u201d Wiz researcher Sagi Tzadik<\/a> said in a blog post<\/a>. \u201cDespite the complexity of the underlying system, the vulnerability is remarkably easy to exploit.\u201d<\/p>\n

<\/a>Full compromise across tenants<\/h2>\n

In its analysis, Wiz detailed how the issue could be escalated from initial command execution to full remote code execution on affected systems.<\/p>\n

\u201cOn GitHub.com, this vulnerability allowed remote code execution on shared storage nodes. We confirmed that millions of public and private repositories belonging to other users and organizations were accessible on the affected nodes,\u201d Tzadik said, adding that the impact was even more severe for self-hosted environments. On GitHub Enterprise Server, the vulnerability granted full server compromise, including access to all hosted repositories and internal secrets<\/a>.<\/p>\n

Wiz confirmed that it did not access the contents of other tenants\u2019 repositories while testing the exploit. \u201c We validated the cross-tenant exposure using only our own test accounts, confirming that the git user\u2019s filesystem permissions would allow reading any repository on the node,\u201d Tzadik added.<\/p>\n

GitHub shared remediation steps and full technical details in a security blog<\/a> post, adding that \u201cGitHub Enterprise Cloud, GitHub Enterprise Cloud with Enterprise Managed Users, GitHub Enterprise Cloud with Data Residency, and github.com were patched on March 4, 2026. No action is required from users of any of these.\u201d<\/p>\n

GitHub Enterprise Server users were urged to patch immediately with fixes available for all supported versions.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

A critical remote code execution (RCE) vulnerability in GitHub could potentially allow attackers to execute arbitrary code on GitHub.com and GitHub Enterprise Server. Uncovered by Wiz researchers, the now-patched bug exploited how GitHub handles server-side \u201cgit push\u201d operations. By crafting malicious input within a standard Git push, an authenticated user could execute arbitrary commands via GitHub\u2019s backend Git processing pipeline. GitHub acknowledged the severity of… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16152","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16152"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16152\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}