GHES CVE Scanner

Detects whether GitHub Enterprise Server (GHES) instances are affected by CVE-2026-3854 and CVE-2026-4821.

CVE Background

CVE-2026-3854 (CVSS 8.7)

Git Push RCE — The babeld component does not sanitize semicolons in git push options, allowing remote code execution.

Affected versions:

Major	Affected Range	Minimum Safe Version
3.14.x	<= 3.14.24	3.14.25
3.15.x	<= 3.15.19	3.15.20
3.16.x	<= 3.16.15	3.16.16
3.17.x	<= 3.17.12	3.17.13
3.18.x	<= 3.18.6	3.18.7
3.19.x	<= 3.19.3	3.19.4
3.20.x+	Not affected	—

CVE-2026-4821 (CVSS 7.2)

Management Console Proxy Injection — Proxy configuration fields do not sanitize shell metacharacters.

Affected versions:

• 3.20.0
• 3.15.x <= 3.15.20
• 3.14.x and all earlier versions

Fixed in: 3.20.1, 3.15.21

Installation

Option 1: pip

pip install ghes-cve-scanner

Option 2: From source

git clone https://github.com/isagoakira/ghes-cve-scanner.git
cd ghes-cve-scanner
pip install -e .

Usage

Single instance scan

python scanner.py scan https://ghes.company.com

Batch scan

python scanner.py scan-batch instances.csv -o report.html

CSV format

url,ip,port
https://ghes1.company.com,10.0.1.1,443
https://ghes2.company.com,10.0.1.2,443

CLI Options

Global options

Option	Description	Default
--timeout N	HTTP timeout in seconds	5
--retries N	Number of retries	2
--verbose, -v	Enable verbose output	false

scan subcommand

Option	Description
url	GHES instance URL
--cve-only CVE_ID	Scan only specified CVE
--format, -f	Output format (console/json/csv/html)
--output, -o	Output file path
--exit-code	Enable exit codes

scan-batch subcommand

Option	Description
file	CSV file path
--url-column N	URL column index
--ip-column N	IP column index
--port-column N	Port column index
--format, -f	Output format
--output, -o	Output file path
--workers N	Max parallel threads
--exit-code	Enable exit codes

Exit Codes

Code	Meaning
0	All instances are safe
1	At least one instance is vulnerable
2	At least one instance could not be scanned

Version Quick Reference

GHES Version	CVE-2026-3854	CVE-2026-4821
3.14.0 - 3.14.24	VULNERABLE	VULNERABLE
3.14.25+	SAFE	VULNERABLE
3.15.0 - 3.15.20	VULNERABLE	VULNERABLE
3.15.21+	SAFE	SAFE
3.16.0 - 3.16.15	VULNERABLE	VULNERABLE
3.16.16+	SAFE	VULNERABLE
3.17.0 - 3.17.12	VULNERABLE	VULNERABLE
3.17.13+	SAFE	VULNERABLE
3.18.0 - 3.18.6	VULNERABLE	VULNERABLE
3.18.7+	SAFE	VULNERABLE
3.19.0 - 3.19.3	VULNERABLE	VULNERABLE
3.19.4+	SAFE	VULNERABLE
3.20.0	SAFE	VULNERABLE
3.20.1+	SAFE	SAFE

Example Scripts

# Single instance scan
./examples/single_instance.sh https://ghes.company.com

# Batch scan
./examples/batch_scan.sh instances.csv report.html

# CI integration
# See examples/ci_integration.sh

Features

• Zero external dependencies — Python standard library only
• Privacy — No data sent to external services
• Graceful degradation — Falls back to HTTP if paramiko is unavailable
• Parallel scanning — Batch scans with ThreadPoolExecutor
• Multiple formats — JSON/CSV/HTML/Console output

License

MIT License