https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:01:20.063400+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-260439 EUVD-2026-260439 2026-10-06T04:01:20.124027+00:00 EUVD-2026-260439 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64494 fkie_cve-2025-64494 2026-10-06T04:01:20.124071+00:00

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.

 https://cve.radiocsirt.org/vuln/ghsa-fv2r-r8mp-pg48 GHSA-fv2r-r8mp-pg48 — Soft Serve does not sanitize ANSI escape sequences in user input 2026-10-06T04:01:20.124107+00:00

Affected: Go: github.com/charmbracelet/soft-serve

### Impact In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.

In the same token, git messages, when printed, are also not being sanitized.

Places in which this was found:

1. Repository Description (pkg/backend/repo.go - SetDescription) 2. Repository Project Name (pkg/backend/repo.go - SetProjectName) 3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69) 4. Git Commit Messages (pkg/ssh/cmd/commit.go:71) 5. Access Token Names (pkg/ssh/cmd/token.go:107) 6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72)

### Patches v0.11.0

### Workarounds No.

### References n/a