Researchers have disclosed a critical remote code execution vulnerability in both GitHub.com and GitHub Enterprise Server that requires almost no sophistication to exploit. CVE-2026-3854 scores 8.7 on the CVSS scale, and the attack path is brutally simple: any authenticated user with push access to a repository can trigger command injection and achieve RCE on the server. No chained exploits, no phishing, no waiting — just a single git push.

What's actually happening here

The flaw is a command injection bug rooted in how GitHub processes certain inputs during a push operation. When the server handles the incoming data, it doesn't adequately sanitise attacker-controlled strings before passing them to a system command. The result is that an attacker can embed shell commands that execute in the server's context.

"Authenticated with push access" sounds like a high bar, but it isn't. Free GitHub accounts can push to their own repos or to any repo where a maintainer has granted collaboration rights. In enterprise environments, where hundreds of developers share access to monorepos, the blast radius of a compromised account — or a malicious insider — is enormous.

Why this one matters more than most

GitHub is the connective tissue of modern software. Your CI/CD pipelines, your dependency graphs, your infrastructure-as-code — all of it flows through git. An attacker who can execute code on a GitHub Enterprise Server instance doesn't just get one codebase; they get the keys to every repository the server hosts, every secret stored in Actions, and potentially every downstream deployment pipeline those repos feed.

For organisations running self-hosted GitHub Enterprise Server, this is a patch-now situation. GitHub.com is a managed service and presumably patched already, but on-premises deployments require action from the operating organisation.

The supply-chain angle

This vulnerability lands in a week already saturated with supply-chain concerns — 73 malicious GlassWorm extensions seeded into OpenVSX, a poisoned element-data npm package with a million monthly downloads, and ongoing targeting of developer tooling. The pattern is consistent: attackers are going after the build environment, not the production environment. Compromise the place where code is written and reviewed, and you get everything downstream for free.

What to watch

GitHub has not yet confirmed whether CVE-2026-3854 has been actively exploited in the wild. Given the straightforward attack path, that silence shouldn't be read as reassurance. Organisations should check their GitHub Enterprise Server version, apply the patch immediately, audit recent push activity for anomalies, and rotate any secrets stored in repository settings or Actions secrets.

Australian organisations running GitHub Enterprise Server on-premises — particularly those in financial services, government, and defence supply chains where source code integrity is a SOCI or ISM concern — should treat this as a P1 remediation task. The ACSC's Australian Government Information Security Manual guidance on patch management timelines sets a 48-hour window for critical vulnerabilities with public exploit details. The clock is running.