Detections
Analytics
SCA: security update for github.com/elves/elvish (GHSA-fpv6-f8jw-rc3r)
high Tenable Cloud Security Plugin ID 414625
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Elvish is a programming language and interactive shell, combined into one package. In versions prior to
0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code
sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the
user has the web UI backend open and visits a compromised or malicious website, the website can send
arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the
the web UI, although it is still possible for the user to build a version from source that includes the
web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or
pkg/prog/web, depending on the exact version). (CVE-2021-41088)
See Also
Plugin Details
Severity: High
ID: 414625
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2021-41088
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/23/2021
Vulnerability Publication Date: 9/23/2021
Reference Information
CVE: CVE-2021-41088