semaphore

v2.18.19 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 21d Infrastructure as Code

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 5 known CVEs

Topics

ansible awx ci-cd devops docker docker-ui

+7 more

go jenkins opentofu pulumi terraform terraform-ui terragrunt

Affected surfaces

auth rbac

Summary

AI summary

Added validation for Git repository URLs, enforced --end-of-options in Git commands, restricted custom roles from shadowing built‑in slugs, and fixed permission resolution for built‑in roles.

Full changelog

v2.18.19 Release Summary

This patch release includes several important security and validation fixes.

Security fixes

Added validation for Git repository URLs to prevent Git option injection.
Added --end-of-options to Git commands to make repository URL and branch handling safer.
Fixed branch override handling: task-level Git branch override is now applied only when the template explicitly allows it.
Prevented custom roles from shadowing built-in role slugs such as owner or manager.
Fixed permission resolution so built-in roles always use their built-in permissions instead of database-defined custom roles.
Added validation to prevent access keys from being updated with a different ID or moved to another project.

Reliability and tests

Added tests for Git URL validation and Git command injection protection.
Added tests for access key update validation.
Added tests for custom role validation and reserved role slugs.
Refactored Git branch resolution into a dedicated helper to make task behavior more consistent.

Security Fixes

Added validation for Git repository URLs to prevent Git option injection
Added `--end-of-options` flag to all Git commands to mitigate command‑injection risks
Restricted custom roles from shadowing reserved built‑in role slugs (e.g., owner, manager)
Fixed permission resolution so built‑in roles always use their inherent permissions rather than conflicting database‑defined custom roles
Prevented access key updates that change the ID or move keys to another project

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track semaphore

Get notified when new releases ship.

About semaphore

Modern UI and powerful API for Ansible, Terraform/OpenTofu/Terragrunt, PowerShell and other DevOps tools.

All releases →