Skip to main content

Improper Neutralization of Escape, Meta, or Control Sequences

CVE-2025-64494

Medium
4.6/10

Summary

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.11.0, there are several places where the user can insert data (e.g. "names"), and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References

Advisory Timeline

  • Published