Threats tagged 'ghsa-fv2r-r8mp-pg48'

Soft Serve versions prior to 0.11.0 do not sanitize ANSI escape sequences in various user input fields such as repository descriptions, project names, git commit author names and messages, access token names, and webhook URLs. This can allow attackers to inject ANSI escape sequences that may be used to display misleading or fake alerts in the user interface. The vulnerability has a medium severity with a CVSS score of 4.6 and was fixed in version 0.11.0.