How GitHub Responded to a Critical Remote Code Execution Vulnerability in the Git Push Pipeline

Introduction

On March 4, 2026, GitHub received a vulnerability report through its Bug Bounty program from researchers at Wiz. The report detailed a critical remote code execution vulnerability affecting github.com, GitHub Enterprise Cloud (GHEC), GHEC with Data Residency, GHEC with Enterprise Managed Users, and GitHub Enterprise Server (GHES). In less than two hours, GitHub validated the finding, deployed a fix to github.com, and launched a forensic investigation that confirmed no exploitation had occurred. This article explains the vulnerability, how the team responded, and what measures are being implemented to prevent similar issues in the future.

Discovery and Validation of the Vulnerability

Bug Bounty Report from Wiz Researchers

The report described a scenario where any user with push access to a repository—including repositories they created—could achieve arbitrary command execution on the GitHub server handling their git push operation. The attack required only a single command: git push with a crafted push option that leveraged an unsanitized character. The simplicity and severity of the potential exploit immediately raised alarms.

Rapid Internal Verification

GitHub's security team acted swiftly. Within 40 minutes of receiving the report, they had reproduced the vulnerability internally and confirmed its critical severity. This prompted an immediate, coordinated response across engineering, security, and operations teams.

Technical Breakdown: How the Exploit Worked

The Role of Git Push Options

When a user pushes code to GitHub, the operation passes through multiple internal services. As part of this process, metadata about the push—such as repository type and the processing environment—is transmitted between services using an internal protocol. Git push options are a legitimate feature that lets clients send arbitrary key-value strings to the server during a push. While intended for benign purposes, these options became the attack vector.

Injection Through Unsanitized Metadata

The vulnerability arose because user-supplied push option values were incorporated into internal metadata without sufficient sanitization. The internal metadata format relied on a delimiter character that coincidentally could also appear in user input. By embedding that delimiter in a push option value, an attacker could inject additional fields that downstream services would interpret as trusted internal data. Essentially, the metadata fields were not properly bounded, allowing malicious input to merge with privileged configuration.

Chaining Attack Steps to Achieve Remote Code Execution

The researchers demonstrated that by chaining several injected values together, they could override the environment in which the push was processed. This allowed them to bypass sandboxing protections that normally constrain hook execution. Once the sandbox was circumvented, arbitrary commands could be executed on the server. The attack chain was sophisticated but required only a single git push command—making it highly dangerous if left unpatched.

Swift Remediation and Forensics

Immediate Fix for github.com

With the root cause identified at 5:45 p.m. UTC on March 4, 2026, GitHub’s engineering team developed and deployed a fix to github.com by 7:00 p.m. UTC—just over an hour later. The fix ensures that user-supplied push option values are properly sanitized before being passed to internal metadata. As a result, they can no longer influence or inject fields into the trusted internal protocol.

Patches for GitHub Enterprise Server (CVE-2026-3854)

For GHES customers, GitHub prepared patches across all supported releases. The following versions contain the security fix and are available immediately: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, 3.20.0 and later. The vulnerability has been assigned CVE-2026-3854. GitHub strongly recommends that all GHES administrators upgrade to one of these patched releases as soon as possible to protect their environments.

Lessons Learned and Future Prevention

While this specific vulnerability has been addressed, the incident underscores the importance of rigorous input validation at trust boundaries. GitHub is investing in automated tools that can detect unsanitized data flows between internal services, and is enhancing its bug bounty program to encourage research focused on the push pipeline. The team also performed a thorough forensic investigation to confirm that no exploitation occurred, providing reassurance that the window of exposure was extremely short.

Conclusion

The response to this critical remote code execution vulnerability demonstrates the value of a robust bug bounty program, rapid incident response, and a security-first engineering culture. Within hours, a potentially devastating exploit was neutralized, and patches were delivered to all affected platforms. By sharing the technical details and response process, GitHub aims to contribute to the broader security community’s understanding of such attacks and encourage continuous improvement in defender practices.