GO-2025-4106
NoneCVSS
—
EPSS
—
Published
Nov 17, 2025
CISA due date
—
The record
Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/charmbracelet/soft-serve | 0 | 0.11.0 |
Related vulnerabilities
- CVE-2025-64494 Soft Serve is a self-hostable Git server for the command line. Same vulnerability
- GO-2026-4353 Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve Also affects github.com/charmbracelet/soft-serve
- CVE-2026-24058 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in… Also affects github.com/charmbracelet/soft-serve
- CVE-2026-22253 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2025-4111 Soft Serve is vulnerable to SSRF through its Webhooks in… Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks Also affects github.com/charmbracelet/soft-serve