4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64494

CVE-2025-64494: Soft Serve does not sanitize ANSI escape sequences in user input

Impact

In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.

In the same token, git messages, when printed, are also not being sanitized.

Places in which this was found:

Repository Description (pkg/backend/repo.go - SetDescription)
Repository Project Name (pkg/backend/repo.go - SetProjectName)
Git Commit Author Names (pkg/ssh/cmd/commit.go:69)
Git Commit Messages (pkg/ssh/cmd/commit.go:71)
Access Token Names (pkg/ssh/cmd/token.go:107)
Webhook URLs (pkg/ssh/cmd/webhooks.go:72)

Patches

v0.11.0

Workarounds

No.

References

n/a

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64494

CVE-2025-64494:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/charmbracelet/soft-serve	go	<= 0.10.0	0.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-fv2r-r8mp-pg48, stems from the lack of sanitization of user-provided input for ANSI escape sequences across multiple components of the Soft Serve application. An attacker could inject these sequences into various fields such as repository descriptions, project names, usernames, and git commit details. When the application later displays this data in a terminal, the embedded ANSI sequences are rendered, allowing the attacker to manipulate the terminal's output. This could be used to mislead users by displaying fake alerts, hiding legitimate information, or otherwise interfering with the user interface.

The patch addresses this issue by introducing a utils.Sanitize function that strips ANSI escape codes from strings. This function is then applied to user input in all the identified vulnerable locations before the data is stored or displayed. The analysis of the patch commit d9639320b8d0ccd76fe6836a042c042b0ebde549 confirms these changes across several files, including pkg/backend/repo.go, pkg/backend/access_token.go, and pkg/ssh/cmd/commit.go. The identified vulnerable functions are the points of entry where this unsanitized data was being processed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64494: Soft Serve does not sanitize ANSI escape sequences in user input

Impact

Patches

Workarounds

References

CVE-2025-64494:

4.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

4.6

4.6

CVE-2025-64494: Soft Serve does not sanitize ANSI escape sequences in user input

Impact

Patches

Workarounds

References

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI