EUVD-2026-58809

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

PT-2026-72121

Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...

MAL-2026-14010 Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-73293

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

CVE-2026-73292

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73294

Semaphore UI prior to versions 2.18.17 and 2.19.5-beta2 is affected by an OS command injection in the repository git_url handling. The flaw allows an attacker with project Manager/Owner privileges to influence CmdGitClient.GetLastRemoteCommitHash via a crafted --upload-pack option sent through PO...

CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-73294 Semaphore U: OS Command Injection

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-73294 Semaphore U: OS Command Injection

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-73293

CVE-2026-73293 affects Semaphore UI. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, the combination of ProjectMiddleware and GetProjectOrGlobalRoleBySlug allows a project manager to create a custom manager role via POST /api/project/{id}/roles with permission bitmask 15, which overri...

CVE-2026-73293 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

CVE-2026-73293

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

CVE-2026-73293 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

CVE-2026-73292

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73292

Semaphore UI (web interface for managing DevOps tools) prior to version 2.18.21 is affected by a CSRF vulnerability in the /api/users/{id}/password endpoint. The endpoint accepts a cross-site request using the authenticated user’s session cookie without CSRF protection or current-password confirm...

CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

PT-2026-71144

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.19 Semaphore UI versions 2.19.0-alpha3 through 2.19.5-beta5 Description ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use the 'POST /api/project/id/roles' endpoint to create a...