Wiz Discloses Critical GitHub Git Vulnerability

Security researchers at Wiz have disclosed a critical vulnerability in GitHub's internal Git infrastructure that could have allowed authenticated users to execute arbitrary code on backend servers using a standard git push command. Tracked as CVE-2026-3854 and rated 8.7 out of 10 on the CVSS severity scale, the flaw affected GitHub.com as well as GitHub Enterprise Server, GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, and GitHub Enterprise Cloud with Enterprise Managed Users.

The vulnerability stemmed from improper sanitization of user-supplied git push options before they were included in internal service headers, known as the XStat header. Because the header format used a semicolon as a delimiter that could appear in user input, attackers could inject additional metadata fields. By chaining multiple injections, they could override environment variables, bypass sandbox protections, and run commands as the git service user, according to GitHub's advisory.

Wiz researchers, who discovered the issue using AI-augmented reverse engineering tools, reported it to GitHub on March 4, 2026. GitHub validated the report and deployed a fix to GitHub.com within two...