Vulnerabilities

Security fix · GHSA-fgxm-5hvv-x4vh

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · charmbracelet/soft-serve HTTP responses disclose

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-fgxm-5hvv-x4vh. A missing EPSS score is not a low risk. Compare charmbracelet/soft-serve HTTP responses disclose with the linked advisory before you change production.

Severity

Medium5.3

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

Go github.com/charmbracelet/soft-serve

## Summary Soft Serve answers Go's requests by walking up the requested path until it finds a repository, then rendering that repository's name and clone URL into a meta tag. The walk checked that each candidate repository existed, but never that the caller could read it. A request for a path inside a private repository, such as , therefore returned naming and its clone URL, even though correctly returned . The same exception in the HTTP access middleware also let requests reach the LFS and dumb-HTTP routes with the repository existence check skipped, where two LFS handlers dereferenced the missing repository and panicked. The same disclosure appears without . The Git and LFS routes answered a repository the caller could not read differently depending on whether it existed: an anonymous clone of a private repository got while a missing one got , and a signed-in user without access got the reverse pattern. Either way, one request confirms whether a guessed name is a private repository. This was found while fixing the go-get issue and is included here because it has the same impact and is fixed in the same release. ## Impact A remote client can learn, with one request per candidate name, which private repositories exist, their exact names, and their clone URLs. Under the shipped default of no account is needed, and an authenticated user without access to the repository gets the same answer. Project names in private deployments are often sensitive (internal codenames, unreleased products, customer names), and this turns them into an enumerable namespace. The Git and LFS routes give the same confirmation for any guessed name, to anonymous and authenticated callers alike, and an invalid header does the same even where credentials are otherwise required. Repository contents, refs, commits, and collaborators are not exposed, and no write path is reachable. The LFS panic is caught by the recovery middleware and returns a ; the server stays up. Hidden repositories are not af