Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/charmbracelet/soft-serve

14 known vulnerabilities (2 critical, 5 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
v0.12.4 (Oct 23, 2026): no advisory affects it
Newest unaffected release
v0.12.4 (Oct 23, 2026), the latest release
Advisories
14 · 2 critical, 5 high, 5 medium
Releases
56 since v0.1.1 (Dec 9, 2021)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 14 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve

    Affected: from 0.5.0, fixed in 0.12.3.

    Fixed in v0.12.3 (released Oct 5, 2026, 31 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in…

    Affected: from 0.6.0, fixed in 0.12.3.

    Fixed in v0.12.3 (released Oct 5, 2026, 31 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users

    Affected: from 0.6.0, fixed in 0.12.3.

    Fixed in v0.12.3 (released Oct 5, 2026, 25 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories

    Affected: from 0.5.0, fixed in 0.12.3.

    Fixed in v0.12.3 (released Oct 5, 2026, 25 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • Soft Serve: Authenticated repo import can clone server-local private repositories

    Affected: from 0.6.0, fixed in 0.11.6.

    Fixed in v0.11.6 (released Mar 19, 2026, 5 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • CVE-2026-30832Critical 9.1

    Soft Serve: SSRF via unvalidated LFS endpoint in repo import

    Affected: from 0.6.0, fixed in 0.11.4.

    Fixed in v0.11.4 (released Mar 5, 2026, 2 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • Soft Serve has Critical Authentication Bypass

    Affected: fixed in 0.11.3.

    Fixed in v0.11.3 (released Jan 21, 2026, 1 day before disclosure).

    The latest release, v0.12.4, is not affected.

  • CVE-2026-22253Medium 5.4

    Soft Serve is missing an authorization check in LFS lock deletion

    Affected: fixed in 0.11.2.

    Fixed in v0.11.2 (released Jan 8, 2026, the day of disclosure).

    The latest release, v0.12.4, is not affected.

  • CVE-2025-64522Critical 9.1

    Soft Serve is vulnerable to SSRF through its Webhooks

    Affected: fixed in 0.11.1.

    Fixed in v0.11.1 (released Nov 10, 2025, the day of disclosure).

    The latest release, v0.12.4, is not affected.

  • CVE-2025-64494Medium 4.6

    Soft Serve does not sanitize ANSI escape sequences in user input

    Affected: fixed in 0.11.0.

    Fixed in v0.11.0 (released Nov 6, 2025, 2 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • Soft Serve is vulnerable to arbitrary file writing through its SSH API

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Aug 27, 2025, 7 days before disclosure).

    The latest release, v0.12.4, is not affected.

  • CVE-2025-22130Medium 5.3

    Soft Serve allows path traversal attacks

    Affected: fixed in 0.8.2.

    Fixed in v0.8.2 (released Jan 7, 2025, 1 day before disclosure).

    The latest release, v0.12.4, is not affected.

  • Soft Serve allows arbitrary code execution by crafting git-lfs requests

    Affected: fixed in 0.7.5.

    Fixed in v0.7.5 (released Jul 31, 2024, 1 day before disclosure).

    The latest release, v0.12.4, is not affected.

  • Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled

    Affected: fixed in 0.6.2.

    Fixed in v0.6.2 (released Oct 2, 2023, 2 days before disclosure).

    The latest release, v0.12.4, is not affected.