What is CVE-2024-41956?

CVE-2024-41956 is a high-severity vulnerability in Charmbracelet Soft-Serve, classified under OS Command Injection. CVSS score: 8.1/10. Published 2024-08-01.

How severe is CVE-2024-41956?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Charmbracelet Soft-Serve

CVE-2024-41956

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.005 (41.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Charmbracelet Soft-serve — versions < 0.7.5

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-41956?: CVE-2024-41956 is a high-severity vulnerability in Charmbracelet Soft-Serve, classified under OS Command Injection. CVSS score: 8.1/10. Published 2024-08-01.
How severe is CVE-2024-41956?: High severity. CVSS v3 base score is 8.1 out of 10.