CVE-2024-41956

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-419575.3Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding CVE-2024-419587.2mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentic CVE-2024-419596.1mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload int CVE-2024-41969.8An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specia CVE-2024-419604.8mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload int CVE-2024-419619.6Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in CVE-2024-419626.3Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set w CVE-2024-419648.1Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only CVE-2024-419654.2Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask th CVE-2024-419678.1A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade CVE-2024-419685.4A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-419698.8A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which