CVE-2026-73294: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in semaphoreui semaphore
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.
AI Analysis
Technical Summary
Semaphore UI versions before 2.18.17 and version 2.19.5-beta2 improperly neutralize special elements in the git_url parameter used in repository handling. This leads to an OS command injection vulnerability (CWE-78) via the --upload-pack option passed to CmdGitClient.GetLastRemoteCommitHash. An authenticated project Manager or Owner can exploit this through the POST /api/project/{id}/repositories endpoint and scheduled commit-hash polling, resulting in arbitrary command execution on the Semaphore server process. The issue is resolved in versions 2.18.17 and 2.19.5-beta2.
Potential Impact
Successful exploitation allows an attacker with project Manager or Owner privileges to execute arbitrary operating system commands on the Semaphore server. This can lead to full compromise of the server, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 9.9 (critical), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Semaphore UI versions 2.18.17 and 2.19.5-beta2. Users should upgrade to at least these versions to remediate the issue. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information in the description.
CVE-2026-73294: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in semaphoreui semaphore
Description
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.
CVSS v3.1
Score 9.9critical
Affected software
pkg:github/semaphoreui/semaphoreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Semaphore UI versions before 2.18.17 and version 2.19.5-beta2 improperly neutralize special elements in the git_url parameter used in repository handling. This leads to an OS command injection vulnerability (CWE-78) via the --upload-pack option passed to CmdGitClient.GetLastRemoteCommitHash. An authenticated project Manager or Owner can exploit this through the POST /api/project/{id}/repositories endpoint and scheduled commit-hash polling, resulting in arbitrary command execution on the Semaphore server process. The issue is resolved in versions 2.18.17 and 2.19.5-beta2.
Potential Impact
Successful exploitation allows an attacker with project Manager or Owner privileges to execute arbitrary operating system commands on the Semaphore server. This can lead to full compromise of the server, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 9.9 (critical), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Semaphore UI versions 2.18.17 and 2.19.5-beta2. Users should upgrade to at least these versions to remediate the issue. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-11T19:42:11.450Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c97d0bf8831d539c5341c
Added to database: 08/12/2026, 15:57:04 UTC
Last enriched: 08/12/2026, 16:11:28 UTC
Last updated: 08/12/2026, 16:26:49 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.