Description

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-12T16:17:22.640Z",
  "pubdate": "2026-08-12T16:17:22.640Z",
  "executiveSummary": "A command injection vulnerability exists in Semaphore UI prior to versions 2.18.17 and 2.19.5-beta2. The flaw resides in the handling of the repository git_url parameter, which allows an attacker-controlled --upload-pack option to be passed directly to the underlying Git client execution flow. This vulnerability impacts Semaphore UI instances managing DevOps tools and exposes the host running the Semaphore server process to severe risk.\nAn authenticated user with Project Manager or Owner privileges can exploit this vulnerability to achieve arbitrary operating system command execution on the target server. Exploitation requires access to specific application endpoints, specifically through POST /api/project/{id}/repositories and via scheduled commit-hash polling mechanisms. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying server infrastructure, potentially leading to complete system takeover.",
  "technicalDetails": "The vulnerability stems from improper input validation and sanitization of the repository git_url parameter within Semaphore UI. Specifically, when processing repository configurations, the application passes the user-supplied git_url directly to CmdGitClient.GetLastRemoteCommitHash. Because argument parsing fails to adequately restrict malicious flags, an attacker can supply command-line options such as --upload-pack to the underlying Git binary execution.\nThe attack flow begins when an authenticated adversary with Project Manager or Owner privileges interacts with the POST /api/project/{id}/repositories endpoint or leverages automated mechanisms like scheduled commit-hash polling. By injecting malicious arguments into the git_url string, the adversary manipulates the invocation of external Git processes executed by the server process. When the application executes the command containing the injected parameters, the operating system evaluates the arguments, allowing the execution of arbitrary OS commands with the privileges of the Semaphore server process.\nThe vulnerable component is the Git client integration module handling remote repository interactions within Semaphore UI. Affected versions comprise all releases prior to 2.18.17 and 2.19.5-beta2. Authentication and project-level privileges (Manager or Owner role) are required to initiate the request, and the attack surface is exposed over the network via the application's REST API and internal polling routines. Post-exploitation impact includes arbitrary command execution on the host system, facilitating lateral movement, data exfiltration, or further infrastructure compromise."
}