CVE-2026-73682 is an OS command injection vulnerability in Semaphore before version 2.18.20. The flaw exists in the processing of the repository git_url parameter, where argument delimiters are not properly neutralized. Authenticated users with Manager or Owner privileges can exploit this by injecting shell commands via the git_url using git's --upload-pack= option. This leads to remote code execution on the Semaphore server host when repository operations are performed using the default cmd_git client.

Successful exploitation allows authenticated users with Manager or Owner roles to execute arbitrary commands on the Semaphore server host, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Manager and Owner roles to trusted users only and monitor repository git_url inputs carefully to prevent injection attempts.