PT-2025-45442 · Unknown · Soft Serve

Published 2025-11-06 · Updated 2025-11-17 · CVE-2025-64494

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Soft Serve versions prior to 0.10.0

Description Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.10.0 do not remove ANSI escape sequences from user-supplied data, such as names, potentially allowing for the display of fake alerts. Git messages are also printed without sanitization. This could allow an attacker to inject malicious code through unsanitized input.

Recommendations Update to version 0.10.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2025-64494

GHSA-FV2R-R8MP-PG48

GO-2025-4106

Affected Products

Soft Serve

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64494.json · Exploit
• https://osv.dev/vulnerability/GHSA-fv2r-r8mp-pg48 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64494 · Security Note
• https://osv.dev/vulnerability/GO-2025-4106 · Vendor Advisory
• https://github.com/charmbracelet/soft-serve · Note
• https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549 · Note
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48 · Note
• https://twitter.com/VulmonFeeds/status/1987002768989565218 · Twitter Post
• https://t.me/CVEtracker/36838 · Telegram Post
• https://t.me/cveNotify/142191 · Telegram Post
• https://twitter.com/CVEnew/status/1986999092069998769 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1oqv4uj/resumen_diario_de_vulnerabilidades_07112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ov498g/resumen_diario_de_vulnerabilidades_12112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1otcofi/resumen_diario_de_vulnerabilidades_10112025 · Reddit Post