Securing the git push pipeline: Responding to a critical remote code execution vulnerability

GitHub's CISO details how the company responded to a critical remote code execution vulnerability (CVE-2026-3854) reported by Wiz researchers on March 4, 2026. The flaw allowed any user with push access to execute arbitrary commands on GitHub servers by injecting unsanitized characters via git push options into internal metadata. GitHub validated, fixed, and deployed a patch to github.com in under two hours, and forensic investigation confirmed no exploitation occurred. GitHub Enterprise Server customers are urged to upgrade to patched releases immediately. The post also covers defense-in-depth improvements, including removing an unnecessary code path from environments where it shouldn't exist.