CVE-2025-64494
Medium · 4.6CVSS
4.6
EPSS
0.2%
Published
Nov 8, 2025
CISA due date
—
The record
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/charmbracelet/soft-serve | 0 | 0.11.0 |
Related vulnerabilities
- GO-2025-4106 Soft Serve does not sanitize ANSI escape sequences in user input in… Same vulnerability
- GO-2026-4353 Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve Also affects github.com/charmbracelet/soft-serve
- CVE-2026-24058 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in… Also affects github.com/charmbracelet/soft-serve
- CVE-2026-22253 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2025-4111 Soft Serve is vulnerable to SSRF through its Webhooks in… Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks Also affects github.com/charmbracelet/soft-serve
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150