Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

CVE-2026-3854 exploits an injection flaw in GitHub's internal X-Stat header protocol. The vulnerability occurs when git push options containing semicolons are copied directly into the X-Stat header without sanitization. Since semicolon is the field delimiter, attackers can inject new fields that override security settings due to last-write-wins semantics. The attack chain involves: 1) Injecting rails_env to bypass sandbox restrictions, 2) Injecting custom_hooks_dir to control hook script directory, 3) Injecting repo_pre_receive_hooks with path traversal to execute arbitrary binaries. On GitHub.com, an additional enterprise mode flag injection is required. The vulnerability allows RCE as the git service user with filesystem access to all repositories on shared storage nodes.