An argument injection vulnerability in Semaphore allows authenticated attackers to execute arbitrary system commands, leading to total compromise of the application.

The application improperly neutralizes argument delimiters when handling Git repository URLs (CWE-88). This permits an authenticated attacker to inject malicious arguments into system commands, resulting in OS command execution.

The CVSS score of 8.8 reflects the high risk of this vulnerability, which allows for unauthorized command execution on the host system. This could lead to the theft of sensitive CI/CD credentials, lateral movement within the network, or complete takeover of the Semaphore deployment.

Immediate Action: Update Semaphore to version 2.18.20 or later to address the argument injection flaw.

Proactive Monitoring: Review repository configuration logs for suspicious or malformed Git URLs and monitor for unexpected child processes spawned by the Semaphore service.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect incoming requests for malicious argument strings, and ensure the Semaphore service runs with the minimum necessary OS permissions.

Public Exploit Available: Unknown

Immediate patching is required to neutralize the command injection vector. Security teams should verify that all integration points involving external repository URLs are properly sanitized and restricted to trusted sources.