GitHub Advisoryadvisory · Go

GHSA-fv2r-r8mp-pg48 Soft Serve does not sanitize ANSI escape sequences in user input

MEDIUM Published 2025-11-06 Modified 2025-11-17 Official page ↗
Aliases
CVE-2025-64494
Ecosystem
Go
Packages
github.com/charmbracelet/soft-serve
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-150
Reviewed
2025-11-06

Affected packages

• Go github.com/charmbracelet/soft-serve: < 0.11.0 → fixed in 0.11.0

Description

Impact In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. Places in which this was found: 1. Repository Description (pkg/backend/repo.go - SetDescription) 2. Repository Project Name (pkg/backend/repo.go - SetProjectName) 3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69) 4. Git Commit Messages (pkg/ssh/cmd/commit.go:71) 5. Access Token Names (pkg/ssh/cmd/token.go:107) 6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72) Patches v0.11.0 Workarounds No. References n/a

Related

Alias · CVE (1)

  • CVE-2025-64494 Soft Serve is a self-hostable Git server for the command line. vulnerability

Weakness · CWE (1)

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness

References