CVE-2026-73682 in Semaphore
Summary
by MITRE • 08/14/2026
Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craft a malicious git_url value using git's --upload-pack= option to inject and execute arbitrary shell commands when the server processes repository operations using the default cmd_git client.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within Semaphore continuous integration platform versions before 2.18.20 and represents a critical command injection flaw that can lead to complete system compromise. The vulnerability specifically affects the handling of git_url parameters during repository operations, where authenticated users with Manager or Owner privileges can exploit this weakness to execute arbitrary commands on the Semaphore server host. The technical implementation involves the use of git's --upload-pack= option which allows attackers to inject shell commands that get executed when the server processes repository operations through the default cmd_git client implementation.
The flaw stems from insufficient input validation and sanitization of the git_url parameter, creating an argument injection vector that bypasses normal security controls. When Semaphore processes repository operations such as cloning or fetching, it passes user-supplied git_url values directly to git commands without proper escaping or validation of special characters. This allows attackers to inject malicious command arguments that get interpreted by the shell, enabling arbitrary code execution with the privileges of the Semaphore service account. The vulnerability is particularly dangerous because it requires only Manager or Owner level access to projects, which is often granted to trusted team members but still represents a significant privilege escalation opportunity.
From an operational impact perspective, this vulnerability allows attackers to achieve complete remote code execution on the Semaphore server, potentially leading to data breaches, system compromise, and further lateral movement within the network. The attacker can leverage this to establish persistent access, exfiltrate sensitive build artifacts or credentials, manipulate CI/CD pipelines, and potentially use the compromised server as a launchpad for attacking other systems in the infrastructure. The vulnerability affects the core functionality of Semaphore's repository handling mechanism, making it a critical threat to any organization relying on the platform for continuous integration and deployment operations.
Mitigation strategies include upgrading to Semaphore version 2.18.20 or later where this vulnerability has been patched through proper input validation and sanitization of git_url parameters. Organizations should also implement network segmentation to limit access to Semaphore servers, enforce principle of least privilege by restricting Manager and Owner roles to only essential personnel, and monitor for suspicious repository operations or command executions. Additional defensive measures include implementing web application firewalls to detect and block malicious git_url patterns, using containerization with restricted privileges for Semaphore services, and conducting regular security assessments of CI/CD environments. This vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in OS Commands) and maps to ATT&CK techniques including T1059.004 (Unix Shell) and T1021.004 (SSH) for lateral movement and privilege escalation activities.
The vulnerability demonstrates the critical importance of input validation in CI/CD platforms where user-supplied parameters are processed through system commands. Organizations should treat this as a template for similar vulnerabilities in other tools that handle external inputs through shell operations, emphasizing the need for proper command injection prevention techniques such as parameterized queries or strict input sanitization. Security teams must prioritize protecting CI/CD environments as they often contain sensitive credentials and can provide attackers with elevated privileges to compromise entire development pipelines and infrastructure.