OS command injection in Semaphore UI git repository handling (CVE-2026-73294)

An OS command injection (CWE-88/CWE-78) vulnerability in Semaphore UI's repository git_url handling allows any user holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. The attacker-controlled git_url is passed unvalidated to exec.Command("git") via the --upload-pack= option, triggered through POST /api/project/{id}/repositories or scheduled commit-hash polling. The command executes in the main Semaphore server process, bypassing remote runner isolation and exposing the master encryption key and every project's secrets. Affected versions: - 2.18.12 - 2.18.13 - 2.18.16 We recommend updating to: 2.18.20. CVSS 9.9 · our assessment: act_now Reference: https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p Details: https://vuln.today/cve/CVE-2026-73294