Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Semaphore UI lets manager run commands on server

CVE-2026-73294 · published 2 months ago
Summary

Versions of Semaphore UI before 2.18.17 (and before 2.19.5‑beta2) let a project manager or owner supply input that causes the server to run arbitrary operating‑system commands. This could let an attacker take control of the host running Semaphore. Upgrade to version 2.18.17 or later (or 2.19.5‑beta2 or later) to stop the problem.

What to do
  • Update semaphoreui semaphore to version 2.18.20 or later.
Affected software
VendorProductAffected versions
semaphoreui semaphore < 2.18.20
Original advisory text
Semaphore U: OS Command Injection
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published12 Aug 2026
Updated30 Sep 2026
First seen15 Aug 2026
Sources
CVE-2026-73294 · OSV
CVE-2026-73682 · NVD
GHSA-xp7j-h7jc-4w8p · GHSA
CVE-2026-73682 · MITRE
Track software like this
Free during beta