Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/charmbracelet/charm

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8GoPublished

    Server-Side Request Forgery in charm

    CVE-2022-29180 · GHSA-4wpp-w5r4-7v5v

    Affected
    • Go github.com/charmbracelet/charm >= 0.9.0, < 0.12.1
    Fixed in
    0.12.1· Vendor fix available
    Issue
    We've discovered a vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched in https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 and is available in release v0.12.1. We recommend that all users running self-hosted charm instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. Additional notes Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. Users running the official Charm Docker images are at minimal risk because the exploit is limited to the containerized filesystem. For more information If you have any questions or comments about this advisory: Open a discussion Email us at vt100@charm.sh Chat with us on Slack <a href="https://charm.sh/"<img alt="the Charm logo"…

    Recommended action: Upgrade to 0.12.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →