"##o _ pre _ receive _ hooks. to understand why, we need to look at how the pre - receive hook binary handles custom hooks. ghes supports admin - defined custom pre - receive hooks - scripts that run before a push is accepted. by reverse engineering the pre - receive binary, we di…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
76%
"github rce vulnerability : cve - 2026 - 3854 breakdown wiz research uncovered a critical vulnerability ( cve - 2026 - 3854 ) in github ' s internal git infrastructure that could have affected both github. com and github enterprise server. by exploiting an injection flaw in github…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1203Exploitation for Client Execution
73%
". git abc1234.. def5678 master - > master with unsandboxed code execution as the git user, we had full control over the ghes instance, including filesystem read / write access and visibility into internal service configuration. from ghes to github. com we had rce on github enterp…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
64%
"out of its designated field and creates new, attacker - controlled fields. consider a push option value that contains a semicolon followed by a security field name. babeld embeds it verbatim, producing a header like : the attacker ' s value wins because it appears later in the he…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
34%
"##ub. com : user / repo. git abc1234.. def5678 main - > main rce on github. com - confirmed. cross - tenant impact rce on github enterprise server is a critical vulnerability. on github. com, the same flaw had broader implications due to the shared infrastructure serving multiple…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.