Skip to content
OpenAdvisories

Package · Go

github.com/semaphoreui/semaphore

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.9
    CVE-2026-73294

    Semaphore U: OS Command Injection

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories an…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go
  • High 8.8
    CVE-2026-73293

    Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager ro…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go
  • High 8.3
    CVE-2026-73292 Public exploit

    Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, a…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go