GHSA-xp7j-h7jc-4w8pPublished
Semaphore U: OS Command Injection
Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-73294 · Microsoft / collected KEV context
CVE-2026-73682 · Microsoft / collected KEV context
osv · GHSA-xp7j-h7jc-4w8p
- https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p
- https://nvd.nist.gov/vuln/detail/CVE-2026-73294
- https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6
- https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf
- https://github.com/semaphoreui/semaphore
- https://github.com/semaphoreui/semaphore/tree/v2.18.17
- https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.