Securing the git push pipeline: Responding to a critical remote code execution vulnerability

With the root cause identified on March, 4, 2026, at 5:45 p. m. UTC, our engineering team developed and deployed a fix to github. com at 7:00 p. m.

UTC that same day. The fix ensures that user-supplied push option values are properly sanitized and can no longer influence internal metadata fields. For GitHub Enterprise Server, we prepared patches across all supported releases (3. 14. 25, 3.

15. 20, 3. 16. 16, 3. 17.

13, 3. 18. 7, 3. 19. 4, 3.

20. 0, or later) and published CVE-2026-3854. These are available today and we strongly recommend that all GHES customers upgrade immediately.