Every CVESearch/Get API key

CVE-2021-41088

Remote code execution via the web UI backend of Elvish

8.0 HighFix available

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.54%Down 0.1 points since Sep 24, 2021
90%50%10%1%

What each source reports

CVE List Score used8.0

Remote code execution via the web UI backend of Elvish

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Record
CVE-2021-41088
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-668
Updated
2026-11-02
EUVDEUVD-2021-20568.0

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Record
EUVD-2021-2056
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-fpv6-f8jw-rc3r8.0

Elvish vulnerable to remote code execution via the web UI backend

Impact

Elvish's backend for the experimental web UI (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI.

The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

Patches

All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Workarounds

Do not use the experimental web UI.

For more information

If you have any questions or comments about this advisory, please email xiaqqaix@gmail.com.

Record
GHSA-fpv6-f8jw-rc3r
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-346, CWE-668
Updated
2026-11-02
NVD8.0

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Record
CVE-2021-41088
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-668, CWE-346
Updated
2026-11-02
OSV8.8

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Record
CVE-2021-41088
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-410888.8

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Record
DEBIAN-CVE-2021-41088
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-fpv6-f8jw-rc3r8.0

Elvish vulnerable to remote code execution via the web UI backend

Impact

Elvish's backend for the experimental web UI (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI.

The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

Patches

All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Workarounds

Do not use the experimental web UI.

For more information

If you have any questions or comments about this advisory, please email xiaqqaix@gmail.com.

Record
GHSA-fpv6-f8jw-rc3r
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-346, CWE-668
Updated
2026-11-02
OSVUBUNTU-CVE-2021-410888.0

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by elvish -web) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Record
UBUNTU-CVE-2021-41088
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGO-2022-0937No score

Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish

Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish

Record
GO-2022-0937
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/elves/elvish
Go
before 0.14.0
0.14.0
elvish
Debian:12
before 0.14.0-1
0.14.0-1
elvish
Debian:13
before 0.14.0-1
0.14.0-1
elvish
Debian:14
before 0.14.0-1
0.14.0-1
elvish
Ubuntu:18.04:LTS
All versions, plus listed versions
0.10.1-10.10.1-20.11+ds1-20.11+ds1-3
None known
elvish
Ubuntu:20.04:LTS
All versions, plus listed versions
0.12+ds1-20.13+ds1-20.13+ds1-2ubuntu0.1
None known
elvish
Ubuntu:22.04:LTS
All versions, plus listed versions
0.15.0-10.16.3-10.17.0-10.17.0-1ubuntu0.1
None known
elvish
Ubuntu:24.04:LTS
All versions, plus listed versions
0.19.2-1build10.20.1-10.20.1-1build10.20.1-1ubuntu0.24.04.10.20.1-1ubuntu0.24.04.20.20.1-1ubuntu0.24.04.3
None known
elvish
Ubuntu:25.10
All versions, plus listed versions
0.21.0-2
None known
elvish
Ubuntu:26.10
All versions, plus listed versions
0.21.0-2build1
None known
elvish
Ubuntu:26.04:LTS
All versions, plus listed versions
0.21.0-20.21.0-2build1
None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41088 is a high vulnerability (CVSS 8.0) in Elv Elvish, published September 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in github.com/elves/elvish 0.14.0.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open