CVE-2026-73294

Semaphore UI prior to versions 2.18.17 and 2.19.5-beta2 is affected by an OS command injection in the repository git_url handling. The flaw allows an attacker with project Manager/Owner privileges to influence CmdGitClient.GetLastRemoteCommitHash via a crafted --upload-pack option sent through PO...