Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/semaphoreui/semaphore

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 critical, 2 high
Registry
pkg.go.dev

Advisories 3

  • CVE-2026-73294Critical 9.9

    Semaphore U: OS Command Injection

    Affected: fixed in 0.0.0-20260704181911-7e8a9434bd81.

  • Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

    Affected: fixed in 0.0.0-20260705182501-bb2a4e1f08c8.

  • Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

    Affected: fixed in 0.0.0-20260707190631-c59c3dc9035b.