What’s Vulnerable › Vulnerabilities

CVE-2025-64494: Soft Serve does not sanitize ANSI escape sequences in user input

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-08 · updated 2026-06-17
• Weakness: CWE-150

Description

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.

Affected products

• charmbracelet soft-serve: through 0.10.0

References

• https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48

Get alerted when CVE-2025-64494 or the next vulnerability affects your stack