CVE-2026-33353 — Vulnetix

CVE-2026-33353 PUBLISHED CVSS 7.099999904632568 HIGH

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This issue has been patched in version 0.11.6.

EPSS 0.02% · 3.5th percentile

Risk Scores

CVSS 4.0

7.099999904632568

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.02%

3.5th percentile

Affected Products

Vendor	Product	Versions
charmbracelet	soft-serve	>= 0.6.0, < 0.11.6, >= 0.6.0, < 0.11.6, >= 0.6.0, < 0.11.6
charm	soft_serve	0.6.0, 0.6.0, 0.6.0
github.com	charmbracelet/soft-serve	0.6.0, 0.6.0, 0.6.0

Exploit Intelligence

https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xgxp-f695-6vrp (nist-nvd)
CIRCL seen: CVE-2026-33353 (circl-sighting)
https://github.com/charmbracelet/soft-serve/commit/c147421caf234bcfc1570c79d728ecbbe5813e55 (circl)
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.6 (circl)
GO-2026-4788.json (github-poc)
GO-2026-4788.json (github-poc)
GO-2026-4788.json (github-poc)
GO-2026-4788.json (github-poc)
GO-2026-4788.json (github-poc)
GO-2026-4788.json (github-poc)

Timeline

Mar 19, 2026 CVE Published
Mar 20, 2026 Security Advisory
Mar 24, 2026 PoC Published
Mar 25, 2026 EPSS Score
Mar 27, 2026 CVE Updated
May 18, 2026 EPSS Score
May 19, 2026 EPSS Score
May 20, 2026 EPSS Score
May 21, 2026 EPSS Score
May 22, 2026 EPSS Score
May 23, 2026 EPSS Score
May 24, 2026 EPSS Score

References

Open in Interactive Console →