by Kastro
Paper/Archive/CVE-2025-64522

CVE-2025-64522

charmbracelet soft-serve — Soft Serve is vulnerable to SSRF through its Webhooks

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 30.7.307 × 206.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

Affected

ProductAffectedFixed inSource
soft-serve< 0.11.1–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitgithub.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9frefgithub.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3brefgithub.com/charmbracelet/soft-serve/releases/tag/v0.11.1