A critical OS command injection vulnerability in Semaphore UI allows authenticated attackers to execute arbitrary code on the host server.

The application fails to properly sanitize the git_url input when interacting with the underlying Git client. This allows an authenticated user with Project Manager or Owner privileges to inject malicious arguments, resulting in remote code execution on the server.

Successful exploitation grants an attacker full control over the Semaphore server process. Given the 9.9 CVSS score, this represents a critical risk of complete system compromise, potential lateral movement into the DevOps environment, and unauthorized access to sensitive CI/CD secrets.

Immediate Action: Update Semaphore UI to version 2.18.17 or 2.19.5-beta2 immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual POST requests to the /api/project/{id}/repositories endpoint and monitor for suspicious child processes spawned by the semaphore service.

Compensating Controls: Restrict access to the Semaphore UI interface to trusted internal networks and implement strict role-based access control to limit the number of users with administrative project permissions.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to the integrity and confidentiality of the entire DevOps pipeline. Administrators must prioritize patching the Semaphore instance to the specified fixed versions to prevent potential full-system compromise by malicious actors.