{"action":"Upgrade github.com/charmbracelet/soft-serve to 0.11.2 or later.","affected":[{"fixed":"0.11.2","introduced":"0"}],"component":"github.com/charmbracelet/soft-serve","cve_ids":["CVE-2026-22253"],"ecosystem":"Go","epss":0.00303,"exploited":false,"fixed_versions":["0.11.2"],"ghsa_id":"GHSA-6jm8-x3g6-r33j","id":"tcs_01M5KGCXCX2AR1W2FTTB2GCVGQ","modified_at":"2026-03-03T04:57:53.289493Z","published_at":"2026-01-12T17:39:39Z","references":["https://osv.dev/vulnerability/GO-2026-4290","https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-6jm8-x3g6-r33j","https://nvd.nist.gov/vuln/detail/CVE-2026-22253","https://github.com/charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4290","url":"https://osv.dev/vulnerability/GO-2026-4290"}],"summary":"Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve"}