What’s Vulnerable › Products

charmbracelet soft-serve vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your charmbracelet soft-serve version is affected

Latest charmbracelet soft-serve vulnerabilities

• CVE-2026-91773 — Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks (CVSS 4.3)
• CVE-2026-33353 — Soft Serve: Authenticated repo import can clone server-local private repositories (CVSS 6.5)
• CVE-2026-30832 — Soft Serve: SSRF via unvalidated LFS endpoint in repo import (CVSS 9.1)
• CVE-2026-24058 — Soft Serve has Critical Authentication Bypass (CVSS 9.8)
• CVE-2026-22253 — Soft Serve is missing an authorization check in LFS lock deletion (CVSS 5.4)
• CVE-2025-64522 — Soft Serve is vulnerable to SSRF through its Webhooks (CVSS 7.6)
• CVE-2025-64494 — Soft Serve does not sanitize ANSI escape sequences in user input (CVSS 4.6)
• CVE-2025-58355 — Soft Serve is vulnerable to arbitrary file writing through its SSH API (CVSS 7.7)
• CVE-2025-22130 — Soft Serve allows path traversal attacks (CVSS 8.8)
• CVE-2023-43809 — Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled (CVSS 7.5)