charmbracelet/soft-serve Security Advisories | GitStock

high2026-03-19

In Soft Serve, an authenticated repo import can clone server-local private repositories

GHSA-xgxp-f695-6vrp · CVE-2026-33353

critical2026-03-06

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import

GHSA-3fvx-xrxq-8jvv · CVE-2026-30832

high2026-01-21

Soft Serve Affected by an Authentication Bypass

GHSA-pchf-49fh-w34r · CVE-2026-24058

medium2026-01-08

Soft Serve is missing an authorization check in LFS lock deletion

GHSA-6jm8-x3g6-r33j · CVE-2026-22253

critical2025-11-10

Soft Serve is vulnerable to SSRF through its Webhooks

GHSA-vwq2-jx9q-9h9f · CVE-2025-64522

medium2025-11-06

Soft Serve does not sanitize ANSI escape sequences in user input

GHSA-fv2r-r8mp-pg48 · CVE-2025-64494

high2025-09-02

Soft Serve vulnerable to arbitrary file writing through SSH API

GHSA-33pr-m977-5w97 · CVE-2025-58355

medium2025-01-08

Soft Serve vulnerable to path traversal attacks

GHSA-j4jw-m6xr-fv6c · CVE-2025-22130

high2024-08-02

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

GHSA-m445-w3xr-vp2f · CVE-2024-41956

high2023-10-02

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled

GHSA-mc97-99j4-vm2v · CVE-2023-43809