GHSA-FGXM-5HVV-X4VH: GHSA-fgxm-5hvv-x4vh: Private Repository Enumeration via Go Module Discovery and HTTP Response…
GHSA-fgxm-5hvv-x4vh: Private Repository Enumeration via Go Module Discovery and HTTP Response Discrepancies in Soft Serve Vulnerability ID: GHSA-FGXM-5HVV-X4VH CVSS Score: 5.3 Published: 2026-10-30 Charmbracelet Soft Serve versions 0.5.0 through 0.12.2 contain an authorization bypass and observable response discrepancy vulnerability in the HTTP Git server. Remote attackers can determine the…
Charmbracelet's Soft Serve package, versions 0.5.0 through 0.12.2, contains a vulnerability that allows private repository enumeration through Go module discovery and HTTP response discrepancies. By sending specially crafted HTTP requests to the Go remote import path, remote attackers can determine the existence, exact names, and clone URLs of private repositories.
This occurs due to an authorization bypass in the GoGetHandler handler, which responds with different HTTP status codes for private and non-existent repositories. The vulnerability is classified as a Medium severity issue (CVSS v3.1 score 5.3) with a potential impact on private repository name and clone URL disclosure. Upgrading to version 0.12.3 resolves the issue, as it enforces authorization checks during Go module resolution and unifies HTTP error responses.
To mitigate the vulnerability, users should upgrade to the patched version, disable the HTTP listener if possible, set anonymous access to no-access, or block ?go-get=1 requests at a reverse proxy or WAF.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
