CVE-2025-64494CWE-150

Soft Serve does not sanitize ANSI escape sequences in user input

Medium · published November 8, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Weakness
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences
Published
2025-11-08T01:19Z
EPSS history
Timeline
  • 08 NOV 01:19Z
    Soft Serve does not sanitize ANSI escape sequences in user input
    cvelistv5