Semaphore UI is vulnerable to OS command injection because attacker‑controlled values are passed unchecked to the underlying Git client during repository management and commit‑hash polling. An attacker who can act as a project Manager or Owner can issue a POST to \/api\/project\/\{id\}\/repositories, supplying a malicious --upload-pack parameter. This allows the execution of arbitrary commands in the Semaphore server process, leading to potential compromise of the host operating system, data exfiltration, or denial of service. The flaw is identified as CWE‑78 (OS Command Injection) and CWE‑88 (Command Injection via critical parameters). The CVSS score of 9.9 indicates a critical security impact.

The issue affects all Semaphore UI deployments running version 2.18.x prior to 2.18.17 and 2.19.x prior to 2.19.5‑beta2. The patch was introduced in commit 7e8a9434bd81b82cf42220151c74801ea97542d6 and commit a7a7a33a64aea382a0726b3722856f298663eacf, and is available in releases v2.18.17 and v2.19.5‑beta2. Products from the vendor semaphoreui:semaphore are therefore impacted.

With a CVSS base score of 9.9, the vulnerability is considered critical. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by interacting with the exposed API endpoint if they possess sufficient project‑level privileges, making the practical risk high. Because the flaw resides in a widely used web interface, an attacker with moderate skill can easily craft the required payload. The high severity score combined with the potential for arbitrary code execution implies that an affected organization should prioritize remediation.