CVE-2026-73682 Remote Code Execution in Semaphore

Semaphore versions prior to 2.18.20 are affected by an OS command injection vulnerability, specifically categorized as argument injection. The flaw exists in the handling of repository 'git_url' configurations. Authenticated users assigned the 'Manager' or 'Owner' role on any project can exploit this by crafting a malicious 'git_url' string containing the '--upload-pack=' git option.

When the application processes repository operations using the internal 'cmd_git' client, the crafted input allows the injection of arbitrary shell commands. Because the 'cmd_git' client executes these commands with the privileges of the Semaphore server application, successful exploitation results in remote code execution on the underlying server host. Given the elevated roles required (Manager/Owner), this vulnerability represents a significant risk for lateral movement or persistence within the CI/CD pipeline infrastructure.

Impact

The vulnerability poses a critical risk to the integrity and availability of Semaphore instances. Successful exploitation allows unauthorized execution of system commands, potentially leading to full system compromise, exfiltration of sensitive source code, or modification of deployment pipelines. Organizations using Semaphore versions below 2.18.20 are impacted, particularly those with internal project environments where account security might be lower or trust models rely on the internal authorization framework.

Recommendation

• Upgrade all instances of Semaphore to version 2.18.20 or later immediately to patch CVE-2026-73682.
• Audit project roles to identify and restrict 'Manager' or 'Owner' permissions to only necessary personnel to minimize the potential attack surface.
• Implement egress filtering on the Semaphore server to prevent the execution of outbound payloads or connection to attacker-controlled C2 infrastructure in the event of successful command injection.