CVE-2026-22253

Description

Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve

Affected packages (2)

• Go/github.com/charmbracelet/soft-servefrom 0, < 0.11.2
• Go/github.com/charmbracelet/soft-servefrom 0, < 0.11.2

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-22253
• PATCHhttps://github.com/charmbracelet/soft-serve
• WEBhttps://github.com/charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42
• WEBhttps://github.com/charmbracelet/soft-serve/security/advisories/GHSA-6jm8-x3g6-r33j