isagoakira/ghes-cve-scannerScans GitHub Enterprise Server instances for CVE-2026-3854 and CVE-2026-4821, providing version-based detection with batch scanning and multiple output formats.
Detects whether GitHub Enterprise Server (GHES) instances are affected by CVE-2026-3854 and CVE-2026-4821.
Git Push RCE — The babeld component does not sanitize semicolons in git push options, allowing remote code execution.
Affected versions:
| Major | Affected Range | Minimum Safe Version |
|---|
| 3.14.x | <= 3.14.24 | 3.14.25 |
| 3.15.x | <= 3.15.19 | 3.15.20 |
| 3.16.x | <= 3.16.15 | 3.16.16 |
| 3.17.x | <= 3.17.12 | 3.17.13 |
| 3.18.x | <= 3.18.6 | 3.18.7 |
| 3.19.x | <= 3.19.3 | 3.19.4 |
| 3.20.x+ | Not affected | — |
Management Console Proxy Injection — Proxy configuration fields do not sanitize shell metacharacters.
Affected versions:
Fixed in: 3.20.1, 3.15.21
pip install ghes-cve-scanner
git clone https://github.com/isagoakira/ghes-cve-scanner.git
cd ghes-cve-scanner
pip install -e .
python scanner.py scan https://ghes.company.com
python scanner.py scan-batch instances.csv -o report.html
url,ip,port
https://ghes1.company.com,10.0.1.1,443
https://ghes2.company.com,10.0.1.2,443
| Option | Description | Default |
|---|---|---|
--timeout N | HTTP timeout in seconds | 5 |
--retries N | Number of retries | 2 |
--verbose, -v | Enable verbose output | false |
| Option | Description |
|---|---|
url | GHES instance URL |
--cve-only CVE_ID | Scan only specified CVE |
--format, -f | Output format (console/json/csv/html) |
--output, -o | Output file path |
--exit-code | Enable exit codes |
| Option | Description |
|---|---|
file | CSV file path |
--url-column N | URL column index |
--ip-column N | IP column index |
--port-column N | Port column index |
--format, -f | Output format |
--output, -o | Output file path |
--workers N | Max parallel threads |
--exit-code | Enable exit codes |
| Code | Meaning |
|---|---|
| 0 | All instances are safe |
| 1 | At least one instance is vulnerable |
| 2 | At least one instance could not be scanned |
| GHES Version | CVE-2026-3854 | CVE-2026-4821 |
|---|---|---|
| 3.14.0 - 3.14.24 | VULNERABLE | VULNERABLE |
| 3.14.25+ | SAFE | VULNERABLE |
| 3.15.0 - 3.15.20 | VULNERABLE | VULNERABLE |
| 3.15.21+ | SAFE | SAFE |
| 3.16.0 - 3.16.15 | VULNERABLE | VULNERABLE |
| 3.16.16+ | SAFE | VULNERABLE |
| 3.17.0 - 3.17.12 | VULNERABLE | VULNERABLE |
| 3.17.13+ | SAFE | VULNERABLE |
| 3.18.0 - 3.18.6 | VULNERABLE | VULNERABLE |
| 3.18.7+ | SAFE | VULNERABLE |
| 3.19.0 - 3.19.3 | VULNERABLE | VULNERABLE |
| 3.19.4+ | SAFE | VULNERABLE |
| 3.20.0 | SAFE | VULNERABLE |
| 3.20.1+ | SAFE | SAFE |
# Single instance scan
./examples/single_instance.sh https://ghes.company.com
# Batch scan
./examples/batch_scan.sh instances.csv report.html
# CI integration
# See examples/ci_integration.sh
MIT License