3 ms·
Remote Code Execution on Github with a single Git push
- brianmcnulty 5mo agoThe tweet is confusing and makes it sound like the RCE was as simple as `git push -o "x;`whatever command`"`, but there are a few more things they have to specify that they mention in their blog post: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-38... It doesn't look like it's very hard to reproduce or find the bug now (especially with the details they mention in their blog post) but I assume they did not want to publish the actual command line. It looks like it affected both GitHub.com and GitHub Enterprise, and it does look like it literally took one git push command.
- giannicmptr1000 5mo agoanything single push is asking for trouble