Major Security Flaw In GitHub Enables Remote Code Execution Across Millions of Repositories

A critical vulnerability discovered within GitHub’s internal infrastructure has raised serious concerns across the global software development community, after researchers revealed it could allow attackers to execute arbitrary code on backend systems using a single command.

The flaw, tracked as CVE-2026-3854, was identified by Wiz Research and affects both GitHub’s cloud platform and its self-hosted enterprise offering, GitHub Enterprise Server (GHES). Security experts warn the vulnerability represents one of the most severe architectural weaknesses uncovered in recent years in a widely used developer platform.