CVE-2026-3854-lab

Flagship Lab 001: From Git Push Options to RCE A local Learning Lab and Research Lab inspired by the publicly documented vulnerability concepts behind CVE-2026-3854. Both experiences use real authenticated Git pushes against ForgeDock, a fictional Git server; the Research Lab. !CAUTION This proje...

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : git push -o '' origin master To review any exploitation of this vulnerability, we recommend th...

CVE-2026-3854

CVE-2026-3854: RCE on GitHub via X-Stat header injection Practical summary of how the vulnerability discovered by Wiz Research in GitHub.com and GitHub Enterprise Server's internal git push pipeline works. Disclaimer This material is for educational purposes and offensive security research. The...

ghes-cve-scanner

GHES CVE Scanner Detects whether GitHub Enterprise Server GHES instances are affected by CVE-2026-3854 and CVE-2026-4821. CVE Background CVE-2026-3854 CVSS 8.7 Git Push RCE — The babeld component does not sanitize semicolons in git push options, allowing remote code execution. Affected versions:...

Linux Distros Unpatched Vulnerability : CVE-2026-102827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

EUVD-2026-89333

simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

CVE-2026-102827

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827

The simple-git Node.js interface for Git operations is vulnerable to command injection in versions prior to 4.0.0 . The root cause is that the blockUnsafeOperationsPlugin only compares option names against literal dangerous spellings, failing to account for Git's support for unambiguous long-opti...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827: Improper Neutralization of Special Elements used in a Command

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...

EUVD-2026-64014

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/shell.py...

CVE-2026-62676

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...