GitHub threat report

CVE-2026-3854, a critical remote code execution vulnerability in GitHub's Git push processing pipeline, was disclosed after researcher Saif Ghani received a $100,000 bounty on July 22, 2026. An unauthenticated attacker could execute arbitrary commands on GitHub backend infrastructure via a specially crafted repository URL during Git operations. The flaw allowed improper handling of repository data without sanitization, potentially enabling access to repository secrets, source code modification, and supply-chain attack vectors. GitHub deployed mitigations through coordinated disclosure.

• GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pi(opens in a new tab)