Security
فارسی
All products

github.com/charmbracelet/soft-serve

Go · Package
12 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGHSA-F3FJ-9625-RV3M · GO-2026-6891Version ranges need review. github.com/charmbracelet/soft-serve Go Medium Fix reported
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesGHSA-FGXM-5HVV-X4VH · GO-2026-6892Version ranges need review. github.com/charmbracelet/soft-serve Go Medium Fix reported
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is EnabledCVE-2023-43809 · GHSA-MC97-99J4-VM2VVersion ranges need review. github.com/charmbracelet/soft-serve Go High Fix reported
In Soft Serve, an authenticated repo import can clone server-local private repositoriesCVE-2026-33353 · GHSA-XGXP-F695-6VRPVersion ranges need review. github.com/charmbracelet/soft-serve Go High Fix reported
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo importCVE-2026-30832 · GHSA-3FVX-XRXQ-8JVVVersion ranges need review. github.com/charmbracelet/soft-serve Go Critical Fix reported
Soft Serve Affected by an Authentication BypassCVE-2026-24058 · GHSA-PCHF-49FH-W34RVersion ranges need review. github.com/charmbracelet/soft-serve Go High Fix reported
Soft Serve is missing an authorization check in LFS lock deletionCVE-2026-22253 · GHSA-6JM8-X3G6-R33JVersion ranges need review. github.com/charmbracelet/soft-serve Go Medium Fix reported
Soft Serve is vulnerable to SSRF through its WebhooksCVE-2025-64522 · GHSA-VWQ2-JX9Q-9H9FVersion ranges need review. github.com/charmbracelet/soft-serve Go Critical Fix reported
Soft Serve does not sanitize ANSI escape sequences in user inputCVE-2025-64494 · GHSA-FV2R-R8MP-PG48Version ranges need review. github.com/charmbracelet/soft-serve Go Medium Fix reported
Soft Serve vulnerable to arbitrary file writing through SSH APICVE-2025-58355 · GHSA-33PR-M977-5W97Version ranges need review. github.com/charmbracelet/soft-serve Go High Fix reported
Soft Serve vulnerable to path traversal attacksCVE-2025-22130 · GHSA-J4JW-M6XR-FV6CVersion ranges need review. github.com/charmbracelet/soft-serve Go Medium Fix reported
soft-serve vulnerable to arbitrary code execution by crafting git-lfs requestsCVE-2024-41956 · GHSA-M445-W3XR-VP2FVersion ranges need review. github.com/charmbracelet/soft-serve Go High Fix reported