Vulnerability GO-2026-4788
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 months ago
March 23, 2026 at 06:16 PM UTC
In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
v0.6.0 - v0.11.5
v0.6.0 - v0.11.5
Summary
In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
Details
In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
14 hours ago
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
v0.6.0 - v0.12.2 GHSA-f3fj-9625-rv3m
v0.6.0 - v0.12.2 GHSA-f3fj-9625-rv3m
Medium Risk
14 hours ago
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
v0.5.0 - v0.12.2 GHSA-fgxm-5hvv-x4vh
v0.5.0 - v0.12.2 GHSA-fgxm-5hvv-x4vh
High Risk
7 months ago
In Soft Serve, an authenticated repo import can clone server-local private repositories
v0.6.0 - v0.11.5 GHSA-xgxp-f695-6vrp
v0.6.0 - v0.11.5 GHSA-xgxp-f695-6vrp
Unknown
7 months ago
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
v0.6.0 - v0.11.3 GO-2026-4634
v0.6.0 - v0.11.3 GO-2026-4634
Critical
7 months ago
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
v0.6.0 - v0.11.3 GHSA-3fvx-xrxq-8jvv
v0.6.0 - v0.11.3 GHSA-3fvx-xrxq-8jvv
Impacted packages
Timeline
Published
7 months ago
March 23, 2026 at 06:16 PM UTC
Fixed (v0.11.6)
7 months ago
March 19, 2026 at 02:21 PM UTC
Last Modified
7 months ago
March 23, 2026 at 06:45 PM UTC