Start for Free
go

github.com/charmbracelet/soft-serve

View on go registry
24 Total advisories
24 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/charmbracelet/soft-serve is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

MEDIUM 5.3
Go

GO-2026-6892

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
MEDIUM 5.9
Go

GO-2026-6891

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
UNKNOWN
Go

GHSA-fgxm-5hvv-x4vh

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve
UNKNOWN
Go

GHSA-f3fj-9625-rv3m

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve
HIGH 7.5
Go

CVE-2023-43809

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
UNKNOWN
Go

CVE-2026-33353

In Soft Serve, an authenticated repo import can clone server-local private repositories
UNKNOWN
Go

CVE-2026-33353

In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
CRITICAL 9.1
Go

CVE-2026-30832

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
UNKNOWN
Go

CVE-2026-30832

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2026-24058

Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2026-22253

Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2025-64522

Soft Serve is vulnerable to SSRF through its Webhooks in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2025-64494

Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2025-58355

Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2025-22130

Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2024-41956

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve
UNKNOWN
Go

CVE-2023-43809

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve
MEDIUM 5.4
Go

CVE-2026-22253

Soft Serve is missing an authorization check in LFS lock deletion
UNKNOWN
Go

CVE-2026-24058

Soft Serve Affected by an Authentication Bypass
MEDIUM 4.6
Go

CVE-2025-64494

Soft Serve does not sanitize ANSI escape sequences in user input
CRITICAL 9.1
Go

CVE-2025-64522

Soft Serve is vulnerable to SSRF through its Webhooks
HIGH 7.7
Go

CVE-2025-58355

Soft Serve vulnerable to arbitrary file writing through SSH API
UNKNOWN
Go

CVE-2025-22130

Soft Serve vulnerable to path traversal attacks
HIGH 8.1
Go

CVE-2024-41956

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes