CVE-2025-64494 - CVE House
Back to Database
Status published Medium CVE-2025-64494

Soft Serve does not sanitize ANSI escape sequences in user input

Vulnerability Description

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64494

Credits & Attribution

No credits recorded in the NVD database.

References

More from charmbracelet

View All →
CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
Critical 9.1
CVE-2025-58355
Soft Serve is vulnerable to arbitrary file writing through its SSH API
High 7.7
CVE-2025-22130
Soft Serve allows path traversal attacks
Medium 5.3
CVE-2024-41956
Soft Serve allows arbitrary code execution by crafting git-lfs requests
High 8.1
CVE-2023-43809
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
High 7.5

Affected Vendor

charmbracelet

View all reports →

Affected Software

soft-serve
Vulnerable Versions:
<= 0.10.0

Timeline

Official Publish: November 8th, 2025
Last Modified: November 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-150

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.