---
title: "CVE-2025-64522: Soft Serve is vulnerable to SSRF through its Webhooks"
url: https://erroneo.us/security/cve/CVE-2025-64522/
description: "CVE-2025-64522 (github.com/charmbracelet/soft-serve (Go)): Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-11-10
date_modified: 2025-11-15
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-64522"
kev: false
cvss: 9.1
epss: 0.00368
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-64522: Soft Serve is vulnerable to SSRF through its Webhooks

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.4% , percentile 29: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 29% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes github.com/charmbracelet/soft-serve (Go) < 0.11.1, fixed in 0.11.1 . Check your lockfile, including transitive dependencies.

## What it is

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

## Affected packages

- Go `github.com/charmbracelet/soft-serve` < 0.11.1 → fixed: 0.11.1

## Affected products (CVE record)

- charmbracelet soft-serve: < 0.11.1

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.37% probability of exploitation activity in the next 30 days; percentile 29.

## Sources

- [GitHub Advisory GHSA-vwq2-jx9q-9h9f](https://github.com/advisories/GHSA-vwq2-jx9q-9h9f)
- [CVE.org record CVE-2025-64522](https://www.cve.org/CVERecord?id=CVE-2025-64522)
- [NVD entry CVE-2025-64522](https://nvd.nist.gov/vuln/detail/CVE-2025-64522)
- [github.com](https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-vwq2-jx9q-9h9f)
- [github.com](https://github.com/charmbracelet/soft-serve/commit/bb73b9a0eea0d902da4811420535842a4f9aae3b)
- [github.com](https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.1)

---
Source page: https://erroneo.us/security/cve/CVE-2025-64522/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt