Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/semaphoreui/semaphore | go | < 0.0.0-20260704181911-7e8a9434bd81 | 0.0.0-20260704181911-7e8a9434bd81 |
Miggo AIRoot Cause AnalysisThe vulnerability is an OS command injection flaw in Semaphore, specifically through git argument injection. The root cause is twofold. First, the git_url provided by a user when creating or updating a repository was not being validated to prevent it from starting with a dash (-). This allowed an attacker to craft a URL that git would interpret as a command-line option, such as --upload-pack=<command>. Second, the functions in db_lib/CmdGitClient.go that execute git commands (Clone, Pull, GetLastRemoteCommitHash, GetRemoteBranches) did not use the --end-of-options separator before passing the user-controlled URL. This combination allowed the malicious URL to be parsed as a git option, leading to arbitrary command execution on the Semaphore server. The vulnerability is triggered when Semaphore's scheduler periodically calls GetLastRemoteCommitHash to check for new commits in a repository linked to a schedule. The patch addresses both issues by adding validation to reject URLs that look like command-line options and by adding the --end-of-options separator to all relevant git command executions.
db.Repository.Validatedb/Repository.go
db_lib.CmdGitClient.GetLastRemoteCommitHashdb_lib/CmdGitClient.go
db_lib.CmdGitClient.Clonedb_lib/CmdGitClient.go
db_lib.CmdGitClient.Pulldb_lib/CmdGitClient.go
db_lib.CmdGitClient.GetRemoteBranchesdb_lib/CmdGitClient.go