Start for Free
MEDIUM 4.6 Go

Soft Serve does not sanitize ANSI escape sequences in user input

GHSA-fv2r-r8mp-pg48 · CVE-2025-64494 · GO-2025-4106

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.

In the same token, git messages, when printed, are also not being sanitized.

Places in which this was found:

  1. Repository Description (pkg/backend/repo.go - SetDescription)
  2. Repository Project Name (pkg/backend/repo.go - SetProjectName)
  3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69)
  4. Git Commit Messages (pkg/ssh/cmd/commit.go:71)
  5. Access Token Names (pkg/ssh/cmd/token.go:107)
  6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72)

Patches

v0.11.0

Workarounds

No.

References

n/a

References

More Go vulnerabilities

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes