github.com/semaphoreui/semaphore
Go3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/semaphoreui/semaphorepage 1 of 1
- CVE-2026-73292HIGHCVSS 8.3EG 8.3✓ Fixed in 0.0.0-20260707190631-c59c3dc9035b2026-08-12
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-pass…
- CVE-2026-73293HIGHCVSS 8.8EG 8.8✓ Fixed in 0.0.0-20260705182501-bb2a4e1f08c82026-08-12
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to creat…
- CVE-2026-73294CRITICALCVSS 9.9EG 9.9✓ Fixed in 0.0.0-20260704181911-7e8a9434bd812026-08-12
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/…
Check whether github.com/semaphoreui/semaphore is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/semaphoreui/semaphore CVEs against the assets you own.
Start Free Scan →