Preliminary research

GitHub RCE Vulnerability: CVE-2026-3854

Sagi Tzadik · Wiz Research · 28 April 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Traces Git push-option delimiters into trusted metadata passed between GitHub services. Following the overwritten fields through their consumers reveals environment and sandbox changes, activation of pre-receive hooks and a traversable hook path, connecting a parsing boundary to server-side execution.

Record

Researcher

Sagi Tzadik

Published by

Wiz Research

Date

28 April 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• GitHub response and technical analysis

Tags

• injection
• parser-differential
• path-traversal
• rce
• github
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Sagi Tzadik, first published at the original source. Preserved copies are kept so the citation survives its host.