CVE-2026-3854
HIGHGitHub Enterprise Server RCE via Git Push Option Injection
Title source: llmExploitation Summary
EIP tracks 10 public exploits for CVE-2026-3854. PoCs published by adminlove520, Hex0rc1st, jenniferreire26.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2026-3854, demonstrating how semicolon injection in Git push options can override security-critical fields in the X-Stat header, leading to RCE. The PoC includes a detailed technical writeup and a Python script that simulates the vulnerability and patch behavior.
Description
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.
Exploits (10)
This repository contains a functional PoC for CVE-2026-3854, demonstrating how semicolon injection in Git push options can override security-critical fields in the X-Stat header, leading to RCE. The PoC includes a detailed technical writeup and a Python script that simulates the vulnerability and patch behavior.
The repository claims to provide an exploit for CVE-2026-3854, a GitHub Enterprise Server RCE vulnerability, but lacks actual exploit code. Instead, it directs users to an external download link, which is a common tactic for malicious or fake PoCs.
The repository claims to provide an exploit for CVE-2026-3854, a remote code execution vulnerability in GitHub Enterprise Server, but only includes a README with a link to an external download. No actual exploit code is present.
The repository contains a Python-based scanner for CVE-2026-3854, which targets GitHub Enterprise Server (GHE) for potential RCE via push option injection. The scanner checks for accessible endpoints but does not include exploit code for achieving RCE.
This repository contains a defensive security tool for detecting vulnerabilities in GitHub Enterprise Server (GHES) instances, specifically CVE-2026-3854 and CVE-2026-4821. It includes version detection and vulnerability checking logic but does not contain exploit code.
The repository contains only a minimal README with no exploit code or technical details. It mentions 'patch bypass testing' and includes two numeric values, but lacks any meaningful content or context.
This repository contains a functional Python-based proof-of-concept for CVE-2026-3854, demonstrating how semicolon injection in Git push options can override security-critical fields in the X-Stat header, leading to unsandboxed RCE. The PoC includes three demonstrations: basic injection, a full RCE chain, and patched behavior.
The repository provides a technical description of CVE-2026-3854, a Remote Code Execution vulnerability in GitHub.com and GitHub Enterprise Server. It explains the exploitation method via command injection in git push options and includes version details for vulnerable and fixed releases.
Technical analysis of CVE-2026-3854, detailing how an authenticated attacker can achieve RCE on GitHub via header injection in the X-Stat header during git push operations. The vulnerability involves improper sanitization of semicolons in push options, allowing manipulation of critical fields like rails_env, custom_hooks_dir, and repo_pre_receive_hooks.
References (13)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H