Semaphore versions before 2.18.20 contain an OS command injection flaw associated with the handling of the git_url field. The vulnerability is an argument injection that allows an authenticated user who holds a Manager or Owner role on any project to insert arbitrary shell commands into the git_url value using git's --upload-pack option. When the server executes repository operations with the default cmd_git client, the malicious command executes on the host, leading to full remote code execution.

Affected systems are installations of the Semaphore application from the vendor Semaphore UI. Any deployment running a Semaphore server version earlier than 2.18.20 is vulnerable; newer releases receive the fix.

The CVSS score of 8.7 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated within the Semaphore web interface and to have Manager or Owner privileges on a project. Attackers can craft a malicious git_url value and trigger the vulnerable repository functionality, resulting in remote code execution on the server host.