CVE-2026-3854-lab

Flagship Lab 001: From Git Push Options to RCE A local Learning Lab and Research Lab inspired by the publicly documented vulnerability concepts behind CVE-2026-3854. Both experiences use real authenticated Git pushes against ForgeDock, a fictional Git server; the Research Lab. !CAUTION This proje...

ghes-cve-scanner

GHES CVE Scanner Detects whether GitHub Enterprise Server GHES instances are affected by CVE-2026-3854 and CVE-2026-4821. CVE Background CVE-2026-3854 CVSS 8.7 Git Push RCE — The babeld component does not sanitize semicolons in git push options, allowing remote code execution. Affected versions:...

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : root@kitploit: git push -o '' origin master To review any exploitation of this vulnerability, ...

cve-2026-3854-test

CVE-2026-3854 patch bypass testing webhook-baseline-test 1777481540 webhook-inject-test 1777481589...

Exploit for Command Injection in Github Enterprise_Server

CVE-2026-3854 - GitHub Enterprise Server that allowed an Remot...

Exploit for Command Injection in Github Enterprise_Server

CVE-2026-3854 — GitHub Enterprise Server RCE via Push Option I...

Exploit for Command Injection in Github Enterprise_Server

CVE-2026-3854 PoC — GitHub RCE via X-Stat Push Option Injectio...

CVE-2026-3854

creationtimestamp| type| source ---|---|--- 2026-03-20 10:34:07+00:00| seen| https://bsky.app/profile/secqube.com/post/3mhicwrgk6i2t 2026-04-28 13:30:00+00:00| seen| https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/ 2026-04-2...