TI-2026-23661 CVE-2026-30832 · GHSA-3fvx-xrxq-8jvv
Soft Serve: SSRF via unvalidated LFS endpoint in repo import
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
charmbracelet
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
charmbracelet records in CISA KEVNo charmbracelet vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Soft Serve · all components
TI-2025-39912 CVE-2025-64522 · GHSA-vwq2-jx9q-9h9f
Soft Serve is vulnerable to SSRF through its Webhooks
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
TI-2023-23497 CVE-2023-43809 · GHSA-mc97-99j4-vm2v
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
TI-2026-25759 CVE-2026-33353 · GHSA-xgxp-f695-6vrp
Soft Serve: Authenticated repo import can clone server-local private repositories
Priority HIGH 70
Soft Serve is a self-hostable Git server for the command line.
TI-2026-17863 CVE-2026-22253 · GHSA-6jm8-x3g6-r33j
Soft Serve is missing an authorization check in LFS lock deletion
Priority MEDIUM 58
Soft Serve is a self-hostable Git server for the command line.
TI-2026-19385 CVE-2026-24058 · GHSA-pchf-49fh-w34r
Soft Serve has Critical Authentication Bypass
Priority LOW 38
Soft Serve is a self-hostable Git server for the command line.
TI-2025-16079 CVE-2025-22130 · GHSA-j4jw-m6xr-fv6c
Soft Serve allows path traversal attacks
Priority LOW 25
Soft Serve is a self-hostable Git server for the command line.