GitHub patches critical 'git push' remote code execution bug - iTnews

GitHub has patched a critical security vulnerability that allowed remote code execution via the 'git push' command. The vulnerability was reported to GitHub by Wiz researchers on March 4. GitHub responded by issuing a fix, which has been applied to its infrastructure. The bug is classified as critical because it could allow an attacker to execute arbitrary code on GitHub's servers, potentially compromising user repositories.

The vulnerability exploits the way GitHub processes incoming git push operations. By sending a specially crafted push request, an attacker could trigger code execution on the server side. The patch closes this attack vector. GitHub has not disclosed further technical details to avoid giving attackers a roadmap.

The fix was applied transparently, requiring no action from users. Wiz is a security research firm that has previously identified vulnerabilities in cloud platforms. The quick response highlights the effectiveness of responsible disclosure. GitHub remains a central platform for code hosting, and this patch helps maintain the security of the software supply chain.