Vendor
charmbracelet
14 known vulnerabilities.
charmbracelet at a glance
- Last 12 months
- 7
- Critical · all time
- 3
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 1 | 1 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 2 | 1 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 2 | 1 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 1 | 0 |
| Dec 2024 | 0 | 0 |
Products
14 results · Feed
-
High 8.1
Charmbracelet Wish 2.0.5 Path Traversal via git Middleware
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-s…
-
Medium 4.3
Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally t…
-
Critical 9.6
Wish has SCP Path Traversal that allows arbitrary file read/write
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server,…
-
High 7.1
Soft Serve: Authenticated repo import can clone server-local private repositories
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, i…
-
Critical 9.1
Soft Serve: SSRF via unvalidated LFS endpoint in repo import
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpo…
-
High 8.1
Soft Serve has Critical Authentication Bypass
Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH…
-
Medium 5.4
Soft Serve is missing an authorization check in LFS lock deletion
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the fo…
-
Critical 9.1
Soft Serve is vulnerable to SSRF through its Webhooks
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cl…
-
Medium 4.6
Soft Serve does not sanitize ANSI escape sequences in user input
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake…
-
High 7.7
Soft Serve is vulnerable to arbitrary file writing through its SSH API
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
-
Medium 5.3
Soft Serve allows path traversal attacks
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories a…
-
High 8.1
Soft Serve allows arbitrary code execution by crafting git-lfs requests
Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve pas…
-
High 7.5
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is a…
-
Medium 5.9
Charm vulnerable to server-side request forgery (SSRF)
A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v…