CVE-2025-64522: Soft Serve is vulnerable to SSRF through its Webhooks

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-10 · updated 2026-06-17
Weakness: CWE-918

Description

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

Affected products

charmbracelet soft-serve: before 0.11.1 — fixed in 0.11.1

How to fix

Upgrade to a fixed version: charmbracelet soft-serve 0.11.1. Check the vendor advisory for mitigations.

References

https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f

Get alerted when CVE-2025-64522 or the next vulnerability affects your stack