CVE-2025-64494
published 2025-11-08CVE-2025-64494: Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g…
PriorityP423medium4.6CVSS 3.1
AVNACLPRLUIRSUCLILAN
EPSS
0.15%
5.0th percentile
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| charmbracelet | soft-serve | <= 0.10.0 | — |
| github.com | charmbracelet_soft-serve | >= 0 < 0.11.0 | 0.11.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
osv·2025-11-17
CVE-2025-64494 Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve
OSV
Soft Serve does not sanitize ANSI escape sequences in user input
osv·2025-11-06
CVE-2025-64494 [MEDIUM] Soft Serve does not sanitize ANSI escape sequences in user input
Soft Serve does not sanitize ANSI escape sequences in user input
### Impact
In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.
In the same token, git messages, when printed, are also not being sanitized.
Places in which this was found:
1. Repository Description (pkg/backend/repo.go - SetDescription)
2. Repository Project Name (pkg/backend/repo.go - SetProjectName)
3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69)
4. Git Commit Messages (pkg/ssh/cmd/commit.go:71)
5. Access Token Names (pkg/ssh/cmd/token.go:107)
6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72)
### Patches
v0.11.0
### Workarounds
No.
### References
n/a
GHSA
Soft Serve does not sanitize ANSI escape sequences in user input
ghsa·2025-11-06
CVE-2025-64494 [MEDIUM] CWE-150 Soft Serve does not sanitize ANSI escape sequences in user input
Soft Serve does not sanitize ANSI escape sequences in user input
### Impact
In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.
In the same token, git messages, when printed, are also not being sanitized.
Places in which this was found:
1. Repository Description (pkg/backend/repo.go - SetDescription)
2. Repository Project Name (pkg/backend/repo.go - SetProjectName)
3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69)
4. Git Commit Messages (pkg/ssh/cmd/commit.go:71)
5. Access Token Names (pkg/ssh/cmd/token.go:107)
6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72)
### Patches
v0.11.0
### Workarounds
No.
### References
n/a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-08
Published