{"id":"GO-2026-6435","revision":"1212cb4c8d17482c99bcd0eb30ecfc81","records":[{"revision":"1212cb4c8d17482c99bcd0eb30ecfc81","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6435","aliases":["CVE-2026-73294","CVE-2026-73682","GHSA-xp7j-h7jc-4w8p"],"title":"Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore","description":"Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:25:29.0587249+00:00","affected":[{"ecosystem":"Go","name":"github.com/semaphoreui/semaphore","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260704181911-7e8a9434bd81"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p","https://nvd.nist.gov/vuln/detail/CVE-2026-73294","https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6","https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf","https://github.com/semaphoreui/semaphore/tree/v2.18.17","https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6435","license":"OSV · upstream source license applies","key":"osv:GO-2026-6435","identifiers":["GO-2026-6435","CVE-2026-73294","CVE-2026-73682","GHSA-xp7j-h7jc-4w8p"]},"retained":false,"historicalAffected":[]}],"coverage":[]}