The "One-Push" GitHub RCE: How CVE-2026-3854 Broke the Sandbox

At the heart of this bug is a classic command injection flaw involving how internal systems talk to each other. When you push code, GitHub passes that data through an internal metadata header called X-Stat.

1. 1The Semicolon Slip-Up: The X-Stat header uses semicolons to separate its data fields. However, GitHub didn't properly sanitize user-supplied git push options. By sneaking semicolons into a push command, an attacker could force the system to read their malicious input as official internal commands.
2. 2The Three-Step Chain: Wiz researchers chained three specific injections to execute the attack. First, they injected a fake rails_env value to bypass GitHub's sandbox constraints. Next, they injected custom_hooks_dir to redirect where hooks are executed. Finally, they used repo_pre_receive_hooks to trigger a path traversal, ultimately executing their own arbitrary code.
3. 3The Cloud Pivot: Even though GitHub.com defaults to turning custom hooks off, that configuration flag is also passed through the vulnerable X-Stat header. Attackers could simply inject a command to flip the flag to "true," effectively enabling the exploit on the cloud environment as well.

Signs You Are Being Targeted:

- Highly unusual git push options appearing in your server's access logs, specifically those containing semicolons or referencing internal variables like rails_env.

- Unexpected execution of hooks outside of your organization's standard CI/CD workflow.

- Anomalous server-side behaviour executed under the git user account.

This isn't just about defacing a repository; it’s about total infrastructure compromise. Because GitHub utilizes shared backend storage nodes, getting RCE as the git user effectively grants cross-tenant exposure. On a shared cloud node, an attacker could theoretically read millions of repositories, stealing proprietary source code and hardcoded secrets regardless of which organization actually owned them.