CVE-2026-3854: fallo de gravedad alta en GitHub Enterprise Server
Remote code execution via git push option injection in GitHub Enterprise Server
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 42%
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
GitHub · Enterprise ServerCVEs relacionadas — GitHub Enterprise Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%CVE-2024-9487CRITICALAn Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabledEPSS 25.6%CVE-2026-9312CRITICALServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpointEPSS 9.2%CVE-2024-1374CRITICALCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement ConsoleEPSS 2.6%CVE-2024-4985CRITICALCVE-2024-4985EPSS 2.6%
Referencias
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.25https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.20https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.16https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.13https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.7https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.4https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854