Description

Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craft a malicious git_url value using git's --upload-pack= option to inject and execute arbitrary shell commands when the server processes repository operations using the default cmd_git client.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T21:17:58.033Z",
  "pubdate": "2026-08-14T21:17:58.033Z",
  "executiveSummary": "Semaphore versions prior to 2.18.20 contain an OS command injection and argument injection vulnerability within the repository git_url handling mechanism.\nThe vulnerability allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the underlying Semaphore server host.\nThe flaw stems from insecure processing of repository operations utilizing the default cmd_git client, where untrusted input supplied via the git_url parameter is passed directly without adequate sanitization or robust argument separation.\nAttackers capable of authenticating with elevated project privileges can craft malicious repository URL values leveraging specific options, such as git's --upload-pack= parameter, to inject and execute arbitrary shell commands directly in the context of the server process.\nThis introduces severe risk implications, potentially leading to total system compromise, unauthorized access to sensitive internal network segments, data exfiltration, and disruption of critical continuous integration and deployment pipelines.\nExploitation requires valid user credentials possessing Manager or Owner privileges within at least one project, highlighting the importance of strict access controls and timely software updates.",
  "technicalDetails": "The vulnerability resides in the repository git_url handling logic of Semaphore versions prior to 2.18.20.\nThe root cause of the issue is an OS command and argument injection flaw introduced when the application processes repository operations using the default cmd_git client.\nSpecifically, user-supplied input provided through the git_url field is inadequately sanitized and improperly handled when constructing system commands executed on the server host.\nAuthentication and privilege requirements dictate that an attacker must hold either the Manager or Owner role on any project within the Semaphore instance to interact with repository configuration and triggering functions.\nThe attack vector involves an authenticated malicious user crafting a specially designed git_url value that incorporates command-line options recognized by the underlying git binary, such as the --upload-pack= option.\nBecause the application passes the manipulated input string directly to the underlying shell or invokes the cmd_git client with unescaped arguments, the injected options are interpreted by the binary as legitimate command parameters rather than data.\nThis allows the attacker to specify arbitrary binaries or shell commands to be executed via options like --upload-pack when the server subsequently initiates repository cloning, fetching, or related git operations.\nUpon processing the malicious repository URL, the server executes the injected payload in the security context of the Semaphore application process, resulting in remote code execution on the host operating system.\nPost-exploitation impact includes full system compromise, capability to read and modify sensitive files, manipulation of other projects, compromise of stored credentials or secrets managed by Semaphore, and lateral movement within the target infrastructure."
}