Go/github.com/charmbracelet/soft-serve CVE-2026-33353: high, EPSS 0.38%

In Soft Serve, an authenticated repo import can clone server-local private repositories

Action: Upgrade github.com/charmbracelet/soft-serve to 0.11.6 or later.

go get github.com/charmbracelet/soft-serve@v0.11.6

Affected

Fixed versions

Sources

• osv: GHSA-xgxp-f695-6vrp
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xgxp-f695-6vrp
• https://nvd.nist.gov/vuln/detail/CVE-2026-33353
• https://github.com/charmbracelet/soft-serve/commit/c147421caf234bcfc1570c79d728ecbbe5813e55
• https://github.com/charmbracelet/soft-serve
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.6

CVE-2026-33353 · published 2026-03-19T19:27:58Z · modified 2026-03-27T22:17:46.827144Z · JSON