EUVD-2026-57320Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable API with low complexity and no UI; requires project Manager/Owner so PR:L; git option injection yields OS command execution escaping the app to the host, giving S:C and full C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.
AnalysisAI
Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve OS command execution on the server by supplying a repository git_url beginning with a dash (e.g. --upload-pack=/tmp/evil.sh). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account holding the project Manager or Owner role (PR:L); it is not exploitable by anonymous or read-only users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user with Manager or Owner rights on any project creates or edits a repository and sets git_url to '--upload-pack=/tmp/evil.sh' (or points it at an attacker-staged script). When Semaphore next runs ls-remote - either immediately on save or during scheduled commit-hash polling - git interprets the value as an option and executes the referenced program as the Semaphore server process, yielding arbitrary OS command execution. … |
| Remediation | Vendor-released patch: upgrade to Semaphore UI 2.18.17 (stable) or 2.19.5-beta2 (pre-release), which add server-side ValidateGitURL rejection of dash-prefixed repository URLs and pass '--end-of-options' to git before the URL in clone/pull/ls-remote operations; see GHSA-xp7j-h7jc-4w8p and commits 7e8a9434bd81b82cf42220151c74801ea97542d6 and a7a7a33a64aea382a0726b3722856f298663eacf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately audit all Semaphore installations to identify vulnerable versions prior to 2.18.17 or 2.19.5-beta2, restrict project manager role assignments to essential personnel only, and enable detailed logging of all git repository configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by expl
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticate
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today