Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Elvish is a programming language and interactive shell, combined into one package. In versions prior to     0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code     sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the     user has the web UI backend open and visits a compromised or malicious website, the website can send     arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the     the web UI, although it is still possible for the user to build a version from source that includes the     web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or     pkg/prog/web, depending on the exact version). (CVE-2021-41088)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Elvish is a programming language and interactive shell, combined into one package. In versions prior to
    0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code
    sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the
    user has the web UI backend open and visits a compromised or malicious website, the website can send
    arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the
    the web UI, although it is still possible for the user to build a version from source that includes the
    web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or
    pkg/prog/web, depending on the exact version). (CVE-2021-41088)

ID	Name	Product	Family	Severity
259267	Linux Distros Unpatched Vulnerability : CVE-2021-41088	Nessus	Misc.	high
414625	SCA: security update for github.com/elves/elvish (GHSA-fpv6-f8jw-rc3r)	Tenable Cloud Security	SCA Checks	high
414625	SCA: security update for github.com/elves/elvish (GHSA-fpv6-f8jw-rc3r)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2021-41088

high

Tenable Plugins

high

high

high