{"id":"CVE-2021-41088","aliases":["GHSA-fpv6-f8jw-rc3r","GO-2022-0937"],"title":"Elvish vulnerable to remote code execution via the web UI backend","summary":"Elvish vulnerable to remote code execution via the web UI backend","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","vendor":"elves","product":"github.com/elves/elvish","ecosystem":"go","affected":["github.com/elves/elvish < 0.14.0"],"patched":["github.com/elves/elvish 0.14.0"],"published":"2021-09-23","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fpv6-f8jw-rc3r","references":[{"url":"https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41088"},{"url":"https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5"},{"url":"https://github.com/elves/elvish"}],"tags":["osv","go"],"epss":0.00537,"epssPercentile":0.42817,"ingestedAt":"2026-07-09T18:56:36.350Z","slug":"CVE-2021-41088","body":"## Overview\n\n### Impact\n\nElvish's backend for the experimental web UI (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.\n\nThe backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.\n\n### Patches\n\nAll Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.\n\nThe issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).\n\n### Workarounds\n\nDo not use the experimental web UI.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email xiaqqaix@gmail.com.\n\n## Affected packages\n\n- `github.com/elves/elvish < 0.14.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/elves/elvish 0.14.0`","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}