Skip to contentCharmbracelet Soft-serve vulnerabilities
- charmbracelet soft-serveSoft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS LocksCVE-2026-917735.3 Medium
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve: Authenticated repo import can clone server-local private repositoriesCVE-2026-33353Fix available7.1 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve: SSRF via unvalidated LFS endpoint in repo importCVE-2026-30832Fix available9.1 Critical
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve has Critical Authentication BypassCVE-2026-24058Fix available8.1 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve is missing an authorization check in LFS lock deletionCVE-2026-22253Fix available5.4 Medium
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve is vulnerable to SSRF through its WebhooksCVE-2025-64522Fix available9.1 Critical
- charmbracelet soft-serveSoft Serve does not sanitize ANSI escape sequences in user inputCVE-2025-64494Fix available4.6 Medium
- charmbracelet soft-serveSoft Serve is vulnerable to arbitrary file writing through its SSH APICVE-2025-58355Fix available7.7 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve allows path traversal attacksCVE-2025-22130Fix available5.3 Medium
- charmbracelet soft-serveSoft Serve allows arbitrary code execution by crafting git-lfs requestsCVE-2024-41956Fix available8.1 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is EnabledCVE-2023-43809Fix available7.5 High