Vulnerability GO-2026-4634
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 months ago
March 10, 2026 at 06:28 PM UTC
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
v0.6.0 - v0.11.3
v0.6.0 - v0.11.3
Summary
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
Details
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
14 hours ago
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
v0.6.0 - v0.12.2 GHSA-f3fj-9625-rv3m
v0.6.0 - v0.12.2 GHSA-f3fj-9625-rv3m
Medium Risk
14 hours ago
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
v0.5.0 - v0.12.2 GHSA-fgxm-5hvv-x4vh
v0.5.0 - v0.12.2 GHSA-fgxm-5hvv-x4vh
Unknown
7 months ago
In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
v0.6.0 - v0.11.5 GO-2026-4788
v0.6.0 - v0.11.5 GO-2026-4788
High Risk
7 months ago
In Soft Serve, an authenticated repo import can clone server-local private repositories
v0.6.0 - v0.11.5 GHSA-xgxp-f695-6vrp
v0.6.0 - v0.11.5 GHSA-xgxp-f695-6vrp
Critical
7 months ago
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
v0.6.0 - v0.11.3 GHSA-3fvx-xrxq-8jvv
v0.6.0 - v0.11.3 GHSA-3fvx-xrxq-8jvv
Impacted packages
Timeline
Published
7 months ago
March 10, 2026 at 06:28 PM UTC
Fixed (v0.11.4)
7 months ago
March 05, 2026 at 09:04 PM UTC
Last Modified
7 months ago
March 23, 2026 at 04:53 AM UTC