Charmbracelet vulnerabilities
We track 10 vulnerabilities in Charmbracelet products across 3 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest Charmbracelet vulnerabilities
- 8.1 High severity
wish: Improper Limitation of a Pathname to a Restricted Directory
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-sl
- 9.6 Critical severity
wish: Improper Limitation of a Pathname to a Restricted Directory
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server,
- 9.1 Critical severity
soft-serve: Server-Side Request Forgery
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoi
- 9.8 Critical severity
soft-serve: Authentication Bypass by Alternate Name
Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH
- 7.6 High severity
soft-serve: Server-Side Request Forgery
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and clo
- 7.7 High severity
soft-serve: Improper Limitation of a Pathname to a Restricted Directory
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
- 8.8 High severity
soft-serve: Improper Limitation of a Pathname to a Restricted Directory
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as
- 8.1 High severity
soft-serve: Improper Neutralization of Special Elements used in an OS Command
Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve pass
- 7.5 High severity
soft-serve: Improper Authentication
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is ac
- 9.8 Critical severity
charm: Server-Side Request Forgery
A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0