Read the docs
TI-2024-27978 Aliases CVE-2024-41956GHSA-m445-w3xr-vp2f

Soft Serve allows arbitrary code execution by crafting git-lfs requests

Priority LOW 38CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Fix Fixed soft-serve (charmbracelet): 0.7.5github.com/charmbracelet/soft-serve (Go): 0.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
charmbraceletsoft-servebefore 0.7.50.7.5Patch availableCNA
—github.com/charmbracelet/soft-serve (Go)before 0.7.50.7.5Patch availableGHSA-m445-w3xr-vp2f
  • soft-serve Vendorcharmbracelet Affected before 0.7.5 Fixed in 0.7.5 Patch available CNA
  • github.com/charmbracelet/soft-serve (Go) Vendor— Affected before 0.7.5 Fixed in 0.7.5 Patch available GHSA-m445-w3xr-vp2f

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:charmbracelet:soft-serve:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:charmbracelet:soft-serve:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA soft-serve (charmbracelet) Fixed in 0.7.5
  • Fix · GHSA-m445-w3xr-vp2f github.com/charmbracelet/soft-serve (Go) Fixed in 0.7.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41956
  2. 2026-10-03 Alias added: GHSA-m445-w3xr-vp2f

References

Advisory 1

Other 4

  • TI-2026-30142 Wish has SCP Path Traversal that allows arbitrary file read/write CVSS 3.1CRITICAL 9.6
  • TI-2026-23661 Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVSS 3.1CRITICAL 9.1
  • TI-2025-39912 Soft Serve is vulnerable to SSRF through its Webhooks CVSS 3.1CRITICAL 9.1
  • TI-2023-23497 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVSS 3.1HIGH 7.5
  • TI-2026-25759 Soft Serve: Authenticated repo import can clone server-local private repositories CVSS 4.0HIGH 7.1
  • TI-2025-36144 Soft Serve is vulnerable to arbitrary file writing through its SSH API CVSS 3.1HIGH 7.7
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences