What’s Vulnerable › Vulnerabilities

CVE-2024-41956: Soft Serve allows arbitrary code execution by crafting git-lfs requests

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-01 · updated 2026-06-17
• Weakness: CWE-78

Description

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.

Affected products

• charmbracelet Soft-Serve: before 0.7.5 — fixed in 0.7.5

How to fix

Upgrade to a fixed version: charmbracelet Soft-Serve 0.7.5. Check the vendor advisory for mitigations.

References

• https://github.com/charmbracelet/soft-serve/commit/4daebdd422a6ba8c04162d023f8be355a8fe3184
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f

Get alerted when CVE-2024-41956 or the next vulnerability affects your stack