https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:41:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73294 <p>Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.</p> <p>Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73294 https://db.gcve.eu/vuln/ghsa-xp7j-h7jc-4w8p <p><strong>Affected:</strong> Go: github.com/semaphoreui/semaphore</p> <p># Summary An OS command injection in repository git_url handling lets any user holding the Manager or Owner role on any project (the normal project-collaborator roles) achieve remote code execution on the Semaphore server host. Using git&#39;s --upload-pack=&lt;cmd&gt; option, an attacker runs arbitrary commands. The command executes inside the main Semaphore server process (via the schedule commit-hash poller), so it runs even when jobs are configured for remote runners — bypassing runner isolation and exposing the master encryption key and every project&#39;s secrets. Reproducible on a default install (git_client: cmd_git); no non-default configuration is required.</p> <p># Details The repository git_url is attacker-controlled (HTTP body) and reaches exec.Command(&#34;git&#34;, ...) unvalidated. Two missing controls cause this:</p> <p>1. git_url is never validated against option injection. Repository.Validate() (db/Repository.go, ~lines 138–156) validates the branch via ValidateGitBranch (db/git_branch.go, which rejects a leading -), but performs no equivalent check on GitURL (only &#34;non-empty&#34;). ValidateRepository (db/Store.go, ~802–806) only checks the SSH key. CreateRepository (db/sql/repository.go, ~76–95) stores it verbatim. Because --upload-pack=... has no scheme:// and no leading /, GetType() (db/Repository.go, ~113–136) classifies it as RepositorySSH and GetGitURL(false) (~72–111) returns it raw/unchanged.</p> <p>2. The git command is built with no -- separator. CmdGitClient.GetLastRemoteCommitHash (db_li…</p> <p><strong>Affected:</strong> Go: github.com/semaphoreui/semaphore</p> <p># Summary An OS command injection in repository git_url handling lets any user holding the Manager or Owner role on any project (the normal project-collaborator roles) achieve remote code execution on the Semaphore server host. Using git&#39;s --upload-pack=&lt;cmd&gt; option, an attacker runs arbitrary commands. The command executes inside the main Semaphore server process (via the schedule commit-hash poller), so it runs even when jobs are configured for remote runners — bypassing runner isolation and exposing the master encryption key and every project&#39;s secrets. Reproducible on a default install (git_client: cmd_git); no non-default configuration is required.</p> <p># Details The repository git_url is attacker-controlled (HTTP body) and reaches exec.Command(&#34;git&#34;, ...) unvalidated. Two missing controls cause this:</p> <p>1. git_url is never validated against option injection. Repository.Validate() (db/Repository.go, ~lines 138–156) validates the branch via ValidateGitBranch (db/git_branch.go, which rejects a leading -), but performs no equivalent check on GitURL (only &#34;non-empty&#34;). ValidateRepository (db/Store.go, ~802–806) only checks the SSH key. CreateRepository (db/sql/repository.go, ~76–95) stores it verbatim. Because --upload-pack=... has no scheme:// and no leading /, GetType() (db/Repository.go, ~113–136) classifies it as RepositorySSH and GetGitURL(false) (~72–111) returns it raw/unchanged.</p> <p>2. The git command is built with no -- separator. CmdGitClient.GetLastRemoteCommitHash (db_li…</p> https://db.gcve.eu/vuln/ghsa-xp7j-h7jc-4w8p