Charmbracelet vulnerabilities

Products

• Soft-serve 11
• Wish 2

Newest

• charmbracelet wish Charmbracelet Wish 2.0.5 Path Traversal via git Middleware CVE-2026-53980 8.6 HighNovember 6, 2026
• charmbracelet soft-serve Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks CVE-2026-91773 5.3 MediumSeptember 15, 2026
• charm wish Wish has SCP Path Traversal that allows arbitrary file read/write CVE-2026-41589 Fix available 9.6 CriticalApril 18, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve: Authenticated repo import can clone server-local private repositories CVE-2026-33353 Fix available 7.1 HighMarch 19, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVE-2026-30832 Fix available 9.1 CriticalMarch 6, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve has Critical Authentication Bypass CVE-2026-24058 Fix available 8.1 HighJanuary 21, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve is missing an authorization check in LFS lock deletion CVE-2026-22253 Fix available 5.4 MediumJanuary 8, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve is vulnerable to SSRF through its Webhooks CVE-2025-64522 Fix available 9.1 CriticalNovember 10, 2025
• charmbracelet soft-serve Soft Serve does not sanitize ANSI escape sequences in user input CVE-2025-64494 Fix available 4.6 MediumNovember 6, 2025
• charmbracelet soft-serve Soft Serve is vulnerable to arbitrary file writing through its SSH API CVE-2025-58355 Fix available 7.7 HighSeptember 2, 2025
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve allows path traversal attacks CVE-2025-22130 Fix available 5.3 MediumJanuary 8, 2025
• charmbracelet soft-serve Soft Serve allows arbitrary code execution by crafting git-lfs requests CVE-2024-41956 Fix available 8.1 HighAugust 1, 2024
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVE-2023-43809 Fix available 7.5 HighOctober 2, 2023
• charm Charm vulnerable to server-side request forgery (SSRF) CVE-2022-29180 Fix available 5.9 MediumMay 7, 2022