CVE-2026-73294

CVE-2026-73294 is a critical (CVSS 9.9) OS command injection (CWE-78/CWE-88) in the open-source Semaphore (semaphoreui) automation/CI server, caused by attacker-controlled repository git_url values being passed to exec.Command("git", ...) unvalidated and without a '--' argument separator, so a crafted URL injects git options such as --upload-pack. Any user holding the standard Manager or Owner role on any project can set such a git_url, and the injected command fires when a project schedule's commit-hash poller runs git ls-remote inside the main server process — reproducible on a default install with no non-default configuration. Because execution happens in the server process rather than in jobs, remote-runner isolation is bypassed and the attacker gains arbitrary code execution on the Semaphore server host with access to the master encryption key and every project's stored secrets (C:H/I:H/A:H, scope changed). All deployments of the affected server are exposed to any project collaborator with these roles; the practical blast radius depends on who can reach the API to edit repositories and schedules. Exploitation status: no public PoC is known, it is not in CISA KEV, and EPSS is low (~0.4% probability of exploitation in 30 days), indicating no known exploitation at this time.

What to do: Audit repositories and schedules for git_url values set by project collaborators and remove or correct any values beginning with '-' (option-injection payloads), and restrict Manager/Owner roles to trusted users until patched. Upgrade to the vendor's patched release when one is announced (no fixed version is specified in the available data); deployments whose configuration allows selecting a non-default git client can move off the vulnerable 'cmd_git' path as an interim mitigation. Check server logs for unexpected 'git ls-remote' invocations with --upload-pack arguments or suspicious child processes spawned by the Semaphore server process.