charmbracelet has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 5.3 (medium). Most affected products: github.com/charmbracelet/soft-serve (2), soft-serve (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- github.com/charmbracelet/soft-serve 2
- soft-serve 1
Worst active — by depth score
GHSA-f3fj-9625-rv3mMedium· 5.9charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users32GHSA-fgxm-5hvv-x4vhMedium· 5.3charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories29CVE-2026-91773Medium· 4.3Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access24
charmbracelet vulnerabilities
CVEs affecting charmbracelet, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
GHSA-fgxm-5hvv-x4vhMedium· 5.3charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
GHSA-f3fj-9625-rv3mMedium· 5.9charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
CVE-2026-91773Medium· 4.3Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumera…