Product by Go

    Github.com/charmbracelet/soft-serve

    10 known vulnerabilities in Github.com/charmbracelet/soft-serve (Go), 0 of them actively exploited (CISA KEV).

    Key figures

    10

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Github.com/charmbracelet/soft-serve (Go)
    CriticalCVE-2026-24058

    Soft Serve has Critical Authentication Bypass

    also in 2 other products

    		9.8
    HighCVE-2023-43809

    Charmbracelet Soft-serve: Improper Authentication

    also in 2 other products

    		7.5
    HighCVE-2025-22130

    Soft Serve allows path traversal attacks

    also in 2 other products

    		8.8
    CriticalCVE-2026-30832

    Soft Serve: SSRF via unvalidated LFS endpoint in repo import

    also in 2 other products

    		9.1
    CriticalCVE-2025-64522

    Soft Serve is vulnerable to SSRF through its Webhooks

    also in 2 other products

    		9.1
    HighCVE-2024-41956

    Soft Serve allows arbitrary code execution by crafting git-lfs requests

    also in 1 other product

    		8.1
    HighCVE-2026-33353

    Soft Serve: Authenticated repo import can clone server-local private repositories

    also in 2 other products

    		6.5
    HighCVE-2025-58355

    Soft Serve is vulnerable to arbitrary file writing through its SSH API

    also in 1 other product

    		7.7
    MediumCVE-2026-22253

    Soft Serve is missing an authorization check in LFS lock deletion

    also in 2 other products

    		5.4
    MediumCVE-2025-64494

    Soft Serve does not sanitize ANSI escape sequences in user input

    also in 1 other product

    		4.6

    All products by Go