TI-2026-30142 CVE-2026-41589 · GHSA-xjvp-7243-rg9h
Wish has SCP Path Traversal that allows arbitrary file read/write
Priority HIGH 76
Wish is an SSH server with defaults and a collection of middlewares.
charmbracelet
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
charmbracelet records in CISA KEVNo charmbracelet vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2026-23661 CVE-2026-30832 · GHSA-3fvx-xrxq-8jvv
Soft Serve: SSRF via unvalidated LFS endpoint in repo import
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
TI-2025-39912 CVE-2025-64522 · GHSA-vwq2-jx9q-9h9f
Soft Serve is vulnerable to SSRF through its Webhooks
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
TI-2023-23497 CVE-2023-43809 · GHSA-mc97-99j4-vm2v
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
TI-2026-25759 CVE-2026-33353 · GHSA-xgxp-f695-6vrp
Soft Serve: Authenticated repo import can clone server-local private repositories
Priority HIGH 70
Soft Serve is a self-hostable Git server for the command line.
TI-2025-36144 CVE-2025-58355 · GHSA-33pr-m977-5w97
Soft Serve is vulnerable to arbitrary file writing through its SSH API
Priority HIGH 67
Soft Serve is a self-hostable Git server for the command line.
TI-2026-17863 CVE-2026-22253 · GHSA-6jm8-x3g6-r33j
Soft Serve is missing an authorization check in LFS lock deletion
Priority MEDIUM 58
Soft Serve is a self-hostable Git server for the command line.
TI-2022-11723 CVE-2022-29180 · GHSA-4wpp-w5r4-7v5v
Charm vulnerable to server-side request forgery (SSRF)
Priority MEDIUM 43
A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server.
TI-2026-85938 CVE-2026-53980 · GHSA-6g36-8q6x-8384
Path traversal in Charmbracelet Wish git middleware
Priority MEDIUM 40
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted re…
TI-2026-19385 CVE-2026-24058 · GHSA-pchf-49fh-w34r
Soft Serve has Critical Authentication Bypass
Priority LOW 38
Soft Serve is a self-hostable Git server for the command line.
TI-2024-27978 CVE-2024-41956 · GHSA-m445-w3xr-vp2f
Soft Serve allows arbitrary code execution by crafting git-lfs requests
Priority LOW 38
Soft Serve is a self-hostable Git server for the command line.
TI-2025-16079 CVE-2025-22130 · GHSA-j4jw-m6xr-fv6c
Soft Serve allows path traversal attacks
Priority LOW 25
Soft Serve is a self-hostable Git server for the command line.
TI-2026-61984 CVE-2026-91773 · GHSA-c9m9-282w-83cp
Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
Priority LOW 24
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access.
TI-2025-39886 CVE-2025-64494 · GHSA-fv2r-r8mp-pg48
Soft Serve does not sanitize ANSI escape sequences in user input
Priority LOW 20
Soft Serve is a self-hostable Git server for the command line.