CVE-2024-41956: soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

August 2, 2024

Any servers using soft-serve server and git

References

github.com/advisories/GHSA-m445-w3xr-vp2f
github.com/charmbracelet/soft-serve
github.com/charmbracelet/soft-serve/commit/4daebdd422a6ba8c04162d023f8be355a8fe3184
github.com/charmbracelet/soft-serve/security/advisories/GHSA-m445-w3xr-vp2f
nvd.nist.gov/vuln/detail/CVE-2024-41956

Code Behaviors & Features

Detect and mitigate CVE-2024-41956 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →