What’s Vulnerable › Vulnerabilities

CVE-2023-39059

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-28 · updated 2026-06-17
• Weakness: CWE-94

Description

An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.

Affected products

• Ansible-Semaphore Ansible Semaphore: 2.8.90

References

• https://gist.github.com/Alevsk/1757da24c5fb8db735d392fd4146ca3a
• https://www.alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations/
• https://gist.github.com/Alevsk/1757da24c5fb8db735d392fd4146ca3a
• https://www.alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations/

Get alerted when CVE-2023-39059 or the next vulnerability affects your stack