{"action":"Upgrade github.com/charmbracelet/soft-serve to 0.11.2 or later.","affected":[{"fixed":"0.11.2","introduced":"0"}],"component":"github.com/charmbracelet/soft-serve","cve_ids":["CVE-2026-22253"],"ecosystem":"Go","epss":0.00303,"exploited":false,"fixed_versions":["0.11.2"],"ghsa_id":"GHSA-6jm8-x3g6-r33j","id":"tcs_01M5KF0BK3PXE82W0KV4HZXRJM","modified_at":"2026-02-03T03:15:16.159865Z","published_at":"2026-01-08T21:01:54Z","references":["https://osv.dev/vulnerability/GHSA-6jm8-x3g6-r33j","https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-6jm8-x3g6-r33j","https://nvd.nist.gov/vuln/detail/CVE-2026-22253","https://github.com/charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42","https://github.com/charmbracelet/soft-serve"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-6jm8-x3g6-r33j","url":"https://osv.dev/vulnerability/GHSA-6jm8-x3g6-r33j"}],"summary":"Soft Serve is missing an authorization check in LFS lock deletion"}