Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Soft Serve (github.com/charmbracelet/soft-serve) versions 0.6.0 through 0.12.2 are affected. A race in SetPrivate can leave a repository that was just made private still readable by unauthenticated users over HTTP, SSH, and git://, until the server restarts. Upgrade to 0.12.3, which removes the stale repository cache. Until then, restarting the server clears stale records, and creating repositories as private from the start avoids the problem.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:11 UTC First seen by agentprime
- 31 Oct 2026, 14:11 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-f3fj-9625-rv3m
- OSV: GHSA-f3fj-9625-rv3m
- github.com/charmbracelet/soft-serve/security/advisories/GHSA-f3fj-9625-rv3m
- github.com/charmbracelet/soft-serve/commit/0a4e6f0b7e063927c7128756e1c1b3db871edabf
- github.com/charmbracelet/soft-serve/commit/5b307b4da4db285f797cc028b381ba4d3d853019
- github.com/charmbracelet/soft-serve/commit/e398b4dde723437f637b06710e0938d349b360e8
- github.com/charmbracelet/soft-serve
- github.com/charmbracelet/soft-serve/releases/tag/v0.12.3