Critical severityNVD Advisory· Published Nov 10, 2025· Updated Nov 12, 2025
Soft Serve is vulnerable to SSRF through its Webhooks
CVE-2025-64522
Description
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/charmbracelet/soft-serveGo | < 0.11.1 | 0.11.1 |
Affected products
2- Range: < 0.11.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-vwq2-jx9q-9h9fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-64522ghsaADVISORY
- github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3bghsax_refsource_MISCWEB
- github.com/charmbracelet/soft-serve/releases/tag/v0.11.1ghsax_refsource_MISCWEB
- github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9fghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.