CVE-2026-3854 GitHub RCE Through X-Stat Push-Option Injectio...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://wiz.io/blog/github-rce-vulnerability-cve-2026-3854
• Blog Title: CVE-2026-3854: GitHub RCE Through X-Stat Push-Option Injection
• Suggested Section: Pentesting CI/CD > Github Security > Git Push Infrastructure and GHES Security, as a new page or subsection covering X-Stat delimiter injection, duplicate-key policy overrides, pre-receive hook sandbox bypass, and hook-path traversal

🎯 Content Summary

Overview

CVE-2026-3854 is an authenticated remote-code-execution vulnerability in the internal Git push infrastructure used by GitHub.com and GitHub Enterprise Server (GHES). It received a CVSS score of 8.7. Any authenticated user who could push to a repository could trigger the flaw with a single SSH-based git push using a standard Git client.

The vulnerability chained delimiter injection in an internal metadata header, last-write-...

🔧 Technical Details

Delimiter injection into trusted internal metadata: When an application serializes user-controlled strings into a delimiter-based protocol without escaping reserved characters, an attacker can terminate the intended field and append arbitrary fields. In this case, a semicolon inside git push -o escaped push_option_N and injected additional X-Stat entries. If the parser accepts duplicate keys with last-write-wins behavior, an injected value appearing later can override authenticated security configuration. Similar protocols should reject reserved delimiters, use structured serialization, reject duplicate security fields, and treat all metadata derived from external input as untrusted.

Configuration injection as a sandbox bypass: Security boundaries must not depend on mutable request metadata. Injecting a non-production rails_env value changed the pre-receive hook runner from its sandboxed prod...

🤖 Agent Actions

Updated src/pentesting-ci-cd/github-security/README.md.

Added a new subsection covering:

• delimiter injection in internal Git push metadata
• duplicate-key / last-write-wins policy override
• sandbox bypass via mutable environment markers
• dormant feature / debug-mode activation
• hook-path traversal leading to executable selection
• detection and hardening ideas

Also added references to:

• https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
• https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/

Verification:

• Only 1 file was changed
• ## References remains at the end of the file
• mdbook build could not be run because mdbook is not installed in this environment (/bin/sh: 1: mdbook: not found)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Content Categories: Based on the analysis, this content was categorized under "Pentesting CI/CD > Github Security > Git Push Infrastructure and GHES Security, as a new page or subsection covering X-Stat delimiter injection, duplicate-key policy overrides, pre-receive hook sandbox bypass, and hook-path traversal".

Repository Maintenance:

• MD Files Formatting: 590 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0