CVE-2026-73294: Semaphore UI: Malicious Git Commands Can Be Run

Semaphore UI's web interface for managing DevOps tools has a security issue that allows a malicious user to run arbitrary system commands on the server. This could potentially allow an attacker to access or modify sensitive data. To fix this issue, update Semaphore UI to version 2.18.17 or 2.19.5-beta2 or later.

• https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801e...
• https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f29...
• https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p
• https://github.com/semaphoreui/semaphore/tree/v2.18.17
• https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73682... Vendor Advisory
• https://github.com/semaphoreui/semaphore Product
• https://github.com/semaphoreui/semaphore/commit/5d87656a680600125fe78edec1f7a0d1... Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-73682 Vendor Advisory
• https://www.vulncheck.com/advisories/semaphore-prior-to-version-os-command-injec... Vendor Advisory
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73294... Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-73294 Vendor Advisory