Soft Serve Git Server ANSI Escape Sequence Injection Vulnerability

A vulnerability exists in Soft Serve, a self-hostable Git server, in versions through 0.10.0. The issue arises from improper sanitization of user input, allowing the injection of ANSI escape sequences. This can be exploited to create misleading alerts. The vulnerability is present in several areas where users can input data, such as repository descriptions, project names, Git commit author names, commit messages, access token names, and webhook URLs.

Impact

Exploitation of this vulnerability could lead to the injection of ANSI escape sequences, allowing for the creation of fake alerts and potentially misleading users.

Remediation

Users can upgrade to Soft Serve version 0.11.0 to address this vulnerability.