Loading...
Skip to main content
GeekWala

CVE-2025-64522 — Vulnerability in...

CRITICAL

Soft Serve is vulnerable to SSRF through its Webhooks

Published November 10, 2025Updated November 17, 2025Source: osv

Summary

SUMMARY We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. AFFECTED COMPONENTS (VERIFIED) 1. Webhook Creation (pkg/ssh/cmd/webhooks.go:125) 2. Backend CreateWebhook (pkg/backend/webhooks.go:17) 3. Backend UpdateWebhook (pkg/backend/webhooks.go:122) 4. Webhook Delivery (pkg/webhook/webhook.go:97) IMPACT This vulnerability allows repository administrators to perform SSRF attacks, potentially enabling: a) Cloud Metadata Theft - Access AWS/Azure/GCP credentials via 169.254.169.254 b) Internal Network Access - Target localhost and private networks (10.x, 192.168.x, 172.16.x) c) Port Scanning - Enumerate internal services via response codes and timing d) Data Exfiltration - Full HTTP responses stored in webhook delivery logs e) Internal API Access - Call internal admin panels and Kubernetes endpoints PROOF OF CONCEPT Simple example demonstrating localhost access: ```sh ssh localhost webhook create my-repo http://127.0.0.1:8080/internal \ --events push --active ``` then push to trigger.

Advisory Timeline

  • First published November 10, 2025 (336 days ago).
  • Last revised November 17, 2025 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/charmbracelet/soft-serve to 0.11.1 or later
go get github.com/charmbracelet/soft-serve@v0.11.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/charmbracelet/soft-serve
go
All versions0.11.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-918
    Server-Side Request Forgery (SSRF)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

References

Frequently Asked Questions

What is CVE-2025-64522?
Soft Serve is vulnerable to SSRF through its Webhooks This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-64522?
CVE-2025-64522 affects github.com/charmbracelet/soft-serve. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-64522 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-vwq2-jx9q-9h9f
GO-2025-4111

Related CVEs

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies