GitHub Vulnerability CVE-2026-3854 Enables Remote Code Execution via git push

GitHub.com and GitHub Enterprise Server are affected by CVE-2026-3854, a command injection flaw with a CVSS score of 8.7. The vulnerability is triggered by a single authenticated "git push" command, allowing an attacker with push access to execute arbitrary code on the server. The flaw exploits a weakness in the GitHub push handling logic, enabling remote code execution without additional privileges. No specific version is mentioned, but the advisory recommends immediate action. The issue was disclosed by security researchers and is actively being exploited in the wild. Users are urged to apply the latest security patches or update to the newest GitHub release. The impact is limited to repositories where the attacker has push rights.