HIGH7.7Go
GHSA-33pr-m977-5w97· CVE-2025-58355, GO-2025-3930Soft Serve vulnerable to arbitrary file writing through SSH API
Modified: 9/8/2025
package
Go/github.com/charmbracelet/soft-serve
pkg:go/github.com/charmbracelet/soft-serve
CRITICAL9.1Go
GHSA-3fvx-xrxq-8jvv· CVE-2026-30832, GO-2026-4634soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
Modified: 3/23/2026
MEDIUM5.4Go
GHSA-6jm8-x3g6-r33j· CVE-2026-22253, GO-2026-4290Soft Serve is missing an authorization check in LFS lock deletion
Modified: 2/3/2026
MEDIUM4.6Go
GHSA-fv2r-r8mp-pg48· CVE-2025-64494, GO-2025-4106Soft Serve does not sanitize ANSI escape sequences in user input
Modified: 11/17/2025
MEDIUMGo
GHSA-j4jw-m6xr-fv6c· CVE-2025-22130, GO-2025-3374Soft Serve vulnerable to path traversal attacks
Modified: 1/8/2025
HIGH8.1Go
GHSA-m445-w3xr-vp2f· CVE-2024-41956, GO-2024-3019soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests
Modified: 8/7/2024
HIGH7.5Go
GHSA-mc97-99j4-vm2v· CVE-2023-43809, GO-2023-2097Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
Modified: 9/10/2026
HIGHGo
GHSA-pchf-49fh-w34r· CVE-2026-24058, GO-2026-4353Soft Serve Affected by an Authentication Bypass
Modified: 2/3/2026
CRITICAL9.1Go
GHSA-vwq2-jx9q-9h9f· CVE-2025-64522, GO-2025-4111Soft Serve is vulnerable to SSRF through its Webhooks
Modified: 11/17/2025
HIGHGo
GHSA-xgxp-f695-6vrp· CVE-2026-33353, GO-2026-4788In Soft Serve, an authenticated repo import can clone server-local private repositories
Modified: 3/27/2026
—Go
GO-2023-2097· CVE-2023-43809, GHSA-mc97-99j4-vm2vSoft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2024-3019· CVE-2024-41956, GHSA-m445-w3xr-vp2fsoft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2025-3374· CVE-2025-22130, GHSA-j4jw-m6xr-fv6cSoft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2025-3930· CVE-2025-58355, GHSA-33pr-m977-5w97Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2025-4106· CVE-2025-64494, GHSA-fv2r-r8mp-pg48Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2025-4111· CVE-2025-64522, GHSA-vwq2-jx9q-9h9fSoft Serve is vulnerable to SSRF through its Webhooks in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2026-4290· CVE-2026-22253, GHSA-6jm8-x3g6-r33jSoft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2026-4353· CVE-2026-24058, GHSA-pchf-49fh-w34rSoft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve
Modified: 3/3/2026
—Go
GO-2026-4634· CVE-2026-30832, GHSA-3fvx-xrxq-8jvvsoft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
Modified: 3/23/2026
—Go
GO-2026-4788· CVE-2026-33353, GHSA-xgxp-f695-6vrpIn Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
Modified: 3/23/2026