CVE-2026-3854: any authenticated GitHub user could RCE the backend with a git push.

[alexreed@mstdn.social]

CVE-2026-3854: any authenticated GitHub user could RCE the backend with a git push. Unsanitized semicolons in push options → X-Stat header injection → sandbox bypass → code execution.

Same day, a survey of 18 months of supply chain attacks all tracing back to GitHub Actions.

Same structural problem at two layers.

New post: https://alexreed.srht.site/blog/github-rce-actions-weakest-link.html

#infosec #supplychain #github #CVE