CVE-2025-64522

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b	Patch
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1	Release Notes
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f	Exploit Vendor Advisory
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2025-11-10 23:15

Updated : 2025-12-31 17:54

NVD link : CVE-2025-64522

Mitre link : CVE-2025-64522

CVE.ORG link : CVE-2025-64522

JSON object : View

Products Affected

charm

soft_serve

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-64522", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "published": "2025-11-10T23:15:41.987", "references": [{"url": "https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability."}, {"lang": "es", "value": "Soft Serve es un servidor Git autoalojable para la l\u00ednea de comandos. Las versiones anteriores a la 0.11.1 tienen una vulnerabilidad SSRF donde las URL de los webhooks no son validadas, permitiendo a los administradores del repositorio crear webhooks que apunten a servicios internos, redes privadas y puntos finales de metadatos en la nube. La versi\u00f3n 0.11.1 corrige la vulnerabilidad."}], "lastModified": "2025-12-31T17:54:07.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "2922232B-1219-488F-A47E-2EC829B02351", "versionEndExcluding": "0.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}