CVE-2026-73294: semaphoreui semaphore OS Command Injection
CVSS: 9.9v3.1CriticalRejected
AliasesGHSA-xp7j-h7jc-4w8pCVE-2026-73682GO-2026-6435
Published 12-08-2026Last modified 12-08-2026
Rejected
This record was rejected and should not be used. The data below is kept for reference.Vulnerability summary
CVE-2026-73294 is a critical (CVSS 9.9) OS Command Injection vulnerability in semaphoreui semaphore. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities.
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)EPSS score
0.65%
0%100%
Low · +0.08 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-73294 published by GitHub
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 3 agree
- OSV · GoEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.08 pp
From 0.57% on 18-09-2026
18-09-202618-10-2026
EPSS score0.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Affected systems
Github.com/semaphoreui1 product
- semaphore< 0.0.0-20260704181911-7e8a9434bd81
Semaphoreui1 product
- semaphore< 2.18.17 | ≥ 2.19.0-alpha3, < 2.19.5-beta2
2 vendors · 2 products
References
7 links- github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8pX Refsource CONFIRMWEBAdvisory
- github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6X Refsource MISCWEBFIX
- github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacfX Refsource MISCWEBFIX
