Semaphore UI CVE-2026-73294

Requires an authenticated account holding the project Manager or Owner role (PR:L); it is not exploitable by anonymous or read-only users. The attacker sets the repository git_url to a value beginning with a dash - specifically a git option such as '--upload-pack=<path/script>' or '-oProxyCommand=<cmd>' - via POST /api/project/{id}/repositories. Execution occurs when Semaphore invokes git ls-remote for that repository, either at save time or through scheduled commit-hash polling, so no victim interaction is needed. Exploitation is limited to versions before 2.18.17 / 2.19.5-beta2; patched builds reject dash-prefixed URLs and append '--end-of-options'.

The signals are largely consistent and point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) reflects network reachability, low complexity, only project-level privileges, no user interaction, and full host compromise with a scope change as code escapes the application into the server OS. The one important nuance is PR:L: exploitation is NOT unauthenticated - an attacker must already hold a Manager or Owner role on a project, which narrows the practical threat to insiders or attackers who have compromised such an account. Offsetting that, the scheduled commit-hash polling path means the payload executes on a timer with no additional interaction, raising reliability. No EPSS score, KEV entry, or SSVC decision data was provided, and no public exploit was identified at analysis time, so I cannot cite an exploitation-probability figure; the absence of KEV suggests no confirmed active exploitation, but the public advisory and fix commits make the technique easy to reconstruct. Given self-hosted Semaphore instances often run with broad access to CI/CD credentials and target infrastructure, even a mid-sized operator should treat this as urgent and patch promptly rather than relying on the privilege requirement as a durable barrier.

An authenticated user with Manager or Owner rights on any project creates or edits a repository and sets git_url to '--upload-pack=/tmp/evil.sh' (or points it at an attacker-staged script). When Semaphore next runs ls-remote - either immediately on save or during scheduled commit-hash polling - git interprets the value as an option and executes the referenced program as the Semaphore server process, yielding arbitrary OS command execution. No public exploit was identified at analysis time, but the fix commits and advisory disclose the exact payload pattern.