Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/semaphoreui/semaphore < 0.0.0-20260704181911-7e8a9434bd81
Fixed in
0.0.0-20260704181911-7e8a9434bd81· Vendor fix available
Issue
An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project (the normal project-collaborator roles) achieve remote code execution on the Semaphore server host. Using git's --upload-pack=<cmd option, an attacker runs arbitrary commands. The command executes inside the main Semaphore server process (via the schedule commit-hash poller), so it runs even when jobs are configured for remote runners — bypassing runner isolation and exposing the master encryption key and every project's secrets. Reproducible on a default install (gitclient: cmdgit); no non-default configuration is required. Details The repository giturl is attacker-controlled (HTTP body) and reaches exec.Command("git", ...) unvalidated. Two missing controls cause this: 1. giturl is never validated against option injection. Repository.Validate() (db/Repository.go, ~lines 138–156) validates the branch via ValidateGitBranch (db/gitbranch.go, which rejects a…
Recommended action: Upgrade to 0.0.0-20260704181911-7e8a9434bd81 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/semaphoreui/semaphore < 0.0.0-20260705182501-bb2a4e1f08c8
Fixed in
0.0.0-20260705182501-bb2a4e1f08c8· Vendor fix available
Issue
Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom project role through POST /api/project/{id}/roles, a route gated only by the CanManageProjectResources permission that manager already holds. The role-creation validator does not reserve the built-in slug names (owner, manager, taskrunner, guest) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug manager carrying the full bitmask 15, including the two owner-only bits CanUpdateProject and CanManageProjectUsers that manager does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager's effective permissions become owner-equivalent. Result: a project…
Recommended action: Upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/semaphoreui/semaphore < 0.0.0-20260707190631-c59c3dc9035b
Fixed in
0.0.0-20260707190631-c59c3dc9035b· Vendor fix available
Issue
The password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI does not implement any CSRF protection: - No CSRF token required - No current password confirmation required - Authentication relies solely on a session cookie (semaphore) with no SameSite enforcement A malicious page can silently change the password of any authenticated user who visits it by submitting the /api/users/<id/password forms. PoC To reproduce the exploit, you can use the following python script: Example : 1 - Run the previous script with the url of the targeted semaphore instance and the id of the targeted user. The script will serve a malicious webpage on port 1337. 2 - Connect to semaphore UI in another tab with the targeted user. 3 - In the same browser, visit the malicious…
Recommended action: Upgrade to 0.0.0-20260707190631-c59c3dc9035b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.