Product
Authenticated users with the task_runner role in Semaphore UI versions up to 2.19.16 can achieve remote code execution by injecting malicious Ansible configuration parameters into task environment payloads.