Critical severity9.1NVD Advisory· Published Nov 10, 2025· Updated Jun 17, 2026
CVE-2025-64522
CVE-2025-64522
Description
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/charmbracelet/soft-serveGo | < 0.11.1 | 0.11.1 |
Affected products
4cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*+ 1 more
- cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*range: <0.11.1
- (no CPE)range: < 0.11.1
- ghsa-coords2 versionspkg:golang/github.com/charmbracelet/soft-servepkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0.11.1+ 1 more
- (no CPE)range: < 0.11.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3bnvdPatchWEB
- github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9fnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-vwq2-jx9q-9h9fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-64522ghsaADVISORY
- github.com/charmbracelet/soft-serve/releases/tag/v0.11.1nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.