charmbracelet vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20241
4. 20254
5. 20266

Newest CVEs

• CVE-2026-91773

  Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

  charmbracelet · soft-serve

  Medium5.3
• CVE-2026-41589

  Wish has SCP Path Traversal that allows arbitrary file read/write

  charmbracelet · wish

  Critical9.6
• CVE-2026-33353

  Soft Serve: Authenticated repo import can clone server-local private repositories

  charmbracelet · soft-serve

  High7.1
• CVE-2026-30832

  Soft Serve: SSRF via unvalidated LFS endpoint in repo import

  charmbracelet · soft-serve

  Critical9.1
• CVE-2026-24058

  Soft Serve has Critical Authentication Bypass

  charmbracelet · soft-serve

  High8.1
• CVE-2026-22253

  Soft Serve is missing an authorization check in LFS lock deletion

  charmbracelet · soft-serve

  Medium5.4
• CVE-2025-64522

  Soft Serve is vulnerable to SSRF through its Webhooks

  charmbracelet · soft-serve

  Critical9.1
• CVE-2025-64494

  Soft Serve does not sanitize ANSI escape sequences in user input

  charmbracelet · soft-serve

  Medium4.6
• CVE-2025-58355

  Soft Serve is vulnerable to arbitrary file writing through its SSH API

  charmbracelet · soft-serve

  High7.7
• CVE-2025-22130

  Soft Serve allows path traversal attacks

  charmbracelet · soft-serve

  Medium5.3