CVE-2025-64522
critical · 9.1Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
9.1
CVSS
0.3%
EPSS (exploit prob.)
28th
EPSS percentile
2025-11-10
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-918
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| charm | soft_serve | < 0.11.1 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b
- https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2025-64522