CVE-2026-3854

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3854
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 Release Notes
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19 Release Notes
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15 Release Notes
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12 Release Notes
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6 Release Notes
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
History

12 Mar 2026, 18:45

Type Values Removed Values Added
CPE cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Github
Github enterprise Server
References () https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 - () https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.24 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19 - () https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.19 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15 - () https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.15 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12 - () https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.12 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6 - () https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.6 - Release Notes
References () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3 - () https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.3 - Release Notes

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de neutralización inadecuada de elementos especiales fue identificada en GitHub Enterprise Server que permitía a un atacante con acceso de push a un repositorio lograr ejecución remota de código en la instancia. Durante una operación de git push, los valores de opción de push proporcionados por el usuario no se sanitizaban correctamente antes de ser incluidos en los encabezados de servicio internos. Debido a que el formato del encabezado interno utilizaba un carácter delimitador que también podía aparecer en la entrada del usuario, un atacante podía inyectar campos de metadatos adicionales a través de valores de opción de push manipulados. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty y ha sido corregida en las versiones de GitHub Enterprise Server 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 y 3.19.3.

10 Mar 2026, 18:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:19

Updated : 2026-03-12 18:45

NVD link : CVE-2026-3854

Mitre link : CVE-2026-3854

CVE.ORG link : CVE-2026-3854

JSON object : View

Products Affected

github

  • enterprise_server
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')