# github.com/charmbracelet/soft-serve (Go) vulnerabilities 14 known vulnerabilities (2 critical, 5 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.12.4 (Oct 23, 2026): no advisory affects it - Newest unaffected release: v0.12.4 (Oct 23, 2026), the latest release - Releases: 56 since v0.1.1 (Dec 9, 2021) - Registry: https://pkg.go.dev/github.com/charmbracelet/soft-serve - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GO-2026-6892: v0.5.0 to v0.12.2 (v0.12.3 is outside it) - GO-2026-6891: v0.6.0 to v0.12.2 (v0.12.3 is outside it) - GHSA-F3FJ-9625-RV3M: v0.6.0 to v0.12.2 (v0.12.3 is outside it) - GHSA-FGXM-5HVV-X4VH: v0.5.0 to v0.12.2 (v0.12.3 is outside it) - CVE-2026-33353: v0.6.0 to v0.11.5 (v0.11.6 is outside it) - CVE-2026-30832: v0.6.0 to v0.11.3 (v0.11.4 is outside it) - CVE-2026-24058: v0.1.1 to v0.11.2 (v0.11.3 is outside it) - CVE-2026-22253: v0.1.1 to v0.11.1 (v0.11.2 is outside it) - CVE-2025-64522: v0.1.1 to v0.11.0 (v0.11.1 is outside it) - CVE-2025-64494: v0.1.1 to v0.10.0 (v0.11.0 is outside it) - CVE-2025-58355: v0.1.1 to v0.9.1 (v0.10.0 is outside it) - CVE-2025-22130: v0.1.1 to v0.8.1 (v0.8.2 is outside it) - CVE-2024-41956: v0.1.1 to v0.7.4 (v0.7.5 is outside it) - CVE-2023-43809: v0.1.1 to v0.6.1 (v0.6.2 is outside it) ## Advisories (14) ### [GO-2026-6892](https://cve.now/GO-2026-6892): charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 0.5.0, fixed in 0.12.3. - Fixed in v0.12.3 (released Oct 5, 2026, 31 days before disclosure). - The latest release, v0.12.4, is not affected. ### [GO-2026-6891](https://cve.now/GO-2026-6891): charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users in… - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 0.6.0, fixed in 0.12.3. - Fixed in v0.12.3 (released Oct 5, 2026, 31 days before disclosure). - The latest release, v0.12.4, is not affected. ### [GHSA-F3FJ-9625-RV3M](https://cve.now/GHSA-F3FJ-9625-RV3M): charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users - Severity: Medium - Published: Oct 30, 2026 - Affected: from 0.6.0, fixed in 0.12.3. - Fixed in v0.12.3 (released Oct 5, 2026, 25 days before disclosure). - The latest release, v0.12.4, is not affected. ### [GHSA-FGXM-5HVV-X4VH](https://cve.now/GHSA-FGXM-5HVV-X4VH): charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories - Severity: Medium - Published: Oct 30, 2026 - Affected: from 0.5.0, fixed in 0.12.3. - Fixed in v0.12.3 (released Oct 5, 2026, 25 days before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2026-33353](https://cve.now/CVE-2026-33353): Soft Serve: Authenticated repo import can clone server-local private repositories - Severity: High 7.1 - Published: Mar 24, 2026 - Affected: from 0.6.0, fixed in 0.11.6. - Fixed in v0.11.6 (released Mar 19, 2026, 5 days before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2026-30832](https://cve.now/CVE-2026-30832): Soft Serve: SSRF via unvalidated LFS endpoint in repo import - Severity: Critical 9.1 - Published: Mar 7, 2026 - Affected: from 0.6.0, fixed in 0.11.4. - Fixed in v0.11.4 (released Mar 5, 2026, 2 days before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2026-24058](https://cve.now/CVE-2026-24058): Soft Serve has Critical Authentication Bypass - Severity: High 8.1 - Published: Jan 22, 2026 - Affected: fixed in 0.11.3. - Fixed in v0.11.3 (released Jan 21, 2026, 1 day before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2026-22253](https://cve.now/CVE-2026-22253): Soft Serve is missing an authorization check in LFS lock deletion - Severity: Medium 5.4 - Published: Jan 8, 2026 - Affected: fixed in 0.11.2. - Fixed in v0.11.2 (released Jan 8, 2026, the day of disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2025-64522](https://cve.now/CVE-2025-64522): Soft Serve is vulnerable to SSRF through its Webhooks - Severity: Critical 9.1 - Published: Nov 10, 2025 - Affected: fixed in 0.11.1. - Fixed in v0.11.1 (released Nov 10, 2025, the day of disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2025-64494](https://cve.now/CVE-2025-64494): Soft Serve does not sanitize ANSI escape sequences in user input - Severity: Medium 4.6 - Published: Nov 8, 2025 - Affected: fixed in 0.11.0. - Fixed in v0.11.0 (released Nov 6, 2025, 2 days before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2025-58355](https://cve.now/CVE-2025-58355): Soft Serve is vulnerable to arbitrary file writing through its SSH API - Severity: High 7.7 - Published: Sep 3, 2025 - Affected: fixed in 0.10.0. - Fixed in v0.10.0 (released Aug 27, 2025, 7 days before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2025-22130](https://cve.now/CVE-2025-22130): Soft Serve allows path traversal attacks - Severity: Medium 5.3 - Published: Jan 8, 2025 - Affected: fixed in 0.8.2. - Fixed in v0.8.2 (released Jan 7, 2025, 1 day before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2024-41956](https://cve.now/CVE-2024-41956): Soft Serve allows arbitrary code execution by crafting git-lfs requests - Severity: High 8.1 - Published: Aug 1, 2024 - Affected: fixed in 0.7.5. - Fixed in v0.7.5 (released Jul 31, 2024, 1 day before disclosure). - The latest release, v0.12.4, is not affected. ### [CVE-2023-43809](https://cve.now/CVE-2023-43809): Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled - Severity: High 7.5 - Published: Oct 4, 2023 - Affected: fixed in 0.6.2. - Fixed in v0.6.2 (released Oct 2, 2023, 2 days before disclosure). - The latest release, v0.12.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/charmbracelet/soft-serve Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.