Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

soft-serve — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in soft-serve, with AI-generated Chinese analysis, references, and POCs.

Vendor: charmbracelet

CVE IDTitleCVSSSeverityPublished
CVE-2026-33353 Soft Serve: Authenticated repo import can clone server-local private repositories CWE-200 8.1 -2026-03-24
CVE-2026-30832 Soft Serve: SSRF via unvalidated LFS endpoint in repo import CWE-918 9.1 Critical2026-03-07
CVE-2026-24058 Soft Serve has Critical Authentication Bypass CWE-289 8.1AIHighAI2026-01-22
CVE-2026-22253 Soft Serve is missing an authorization check in LFS lock deletion CWE-863 5.4 Medium2026-01-08
CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks CWE-918 9.1 Critical2025-11-10
CVE-2025-64494 Soft Serve does not sanitize ANSI escape sequences in user input CWE-150 4.6 Medium2025-11-08
CVE-2025-58355 Soft Serve is vulnerable to arbitrary file writing through its SSH API CWE-22 7.7 High2025-09-03
CVE-2025-22130 Soft Serve allows path traversal attacks CWE-22 8.8 -2025-01-08
CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests CWE-78 8.1 High2024-08-01
CVE-2023-43809 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CWE-287 7.5 High2023-10-04

All 10 known CVE vulnerabilities affecting soft-serve with full Chinese analysis, references, and POCs where available.