Medium severity4.6OSV Advisory· Published Nov 8, 2025· Updated Apr 15, 2026
CVE-2025-64494
CVE-2025-64494
Description
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/charmbracelet/soft-serveGo | < 0.11.0 | 0.11.0 |
Affected products
2- Range: v0.1.0, v0.1.1, v0.1.2, …
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.