---
id: CVE-2021-41088
aliases:
  - GHSA-fpv6-f8jw-rc3r
  - GO-2022-0937
title: Elvish vulnerable to remote code execution via the web UI backend
summary: Elvish vulnerable to remote code execution via the web UI backend
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H'
vendor: elves
product: github.com/elves/elvish
ecosystem: go
affected:
  - github.com/elves/elvish < 0.14.0
patched:
  - github.com/elves/elvish 0.14.0
published: '2021-09-23'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fpv6-f8jw-rc3r'
references:
  - url: 'https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3r'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41088'
  - url: >-
      https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5
  - url: 'https://github.com/elves/elvish'
tags:
  - osv
  - go
epss: 0.00537
epssPercentile: 0.42817
ingestedAt: '2026-07-09T18:56:36.350Z'
---

## Overview

### Impact

Elvish's backend for the experimental web UI (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.

The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

### Patches

All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

### Workarounds

Do not use the experimental web UI.

### For more information

If you have any questions or comments about this advisory, please email xiaqqaix@gmail.com.

## Affected packages

- `github.com/elves/elvish < 0.14.0`

## Remediation

Upgrade to a patched release:

- `github.com/elves/elvish 0.14.0`