CVE-2026-73682

Received Received - Intake

OS Command Injection in Semaphore Prior to 2.18.20

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description

Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craft a malicious git_url value using git's --upload-pack= option to inject and execute arbitrary shell commands when the server processes repository operations using the default cmd_git client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-14

Generated

2026-08-15

AI Q&A

2026-08-15

EPSS Evaluated

N/A

NVD

CVE-2026-73682

Affected Vendors & Products

Vendor	Product	Version / Range
semaphore	semaphore	to 2.18.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

Semaphore versions before 2.18.20 have an OS command injection flaw in the repository git_url handling. Authenticated users with Manager or Owner roles on any project can execute remote code on the Semaphore server by crafting a malicious git_url using git's --upload-pack= option to inject shell commands during repository operations.

Impact Analysis

An attacker with Manager or Owner access could execute arbitrary commands on the server, potentially leading to data theft, server compromise, or further network infiltration. This could disrupt services or expose sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Semaphore to version 2.18.20 or later to address the OS command injection vulnerability in repository git_url handling.

Hi! I’m here to help you understand CVE-2026-73682. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70