CVE-2025-64494
mediumpriority · track · 0EPSS 0.002 · 9 %ileEUUSEPSS · scored 2026-10-28
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-fv2r-r8mp-pg48Soft Serve does not sanitize ANSI escape sequences in user input2025-11-06ghsa · osvUS
### Impact In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. Places in which this was found: 1. Repository Description (pkg/backend/repo.go - SetDescription) 2. Repository Project Name (pkg/backend/repo.go - SetProjectName) 3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69) 4. Git Commit Messages (pkg/ssh/cmd/commit.go:71) 5. Access Token Names (pkg/ssh/cmd/token.go:107) 6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72) ### Patches v0.11.0 ### Workarounds No. ### References n/a
- GO-2025-4106Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve2025-11-17vendor · osvUS
Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-64494cnnvd
- https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549cnnvd
- https://github.com/charmbracelet/soft-serve/releasesPatchcnnvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48cnnvd
- https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549enisa_euvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48enisa_euvd
- https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549nvd
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan