Detections
Analytics

Chainguard: yazi: security update to 26.9.1-r5

medium Tenable Cloud Security Plugin ID 476397

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to
 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record
 in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into
 each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak
 the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent
 process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.
 (CVE-2026-111061)

Solution

Update the yazi library and its related packages to version 26.9.1-r5 or later.

Plugin Details

Severity: Medium

ID: 476397

Version: Revision 1.1

Type: Local

Published: 10/21/2026

Updated: 10/21/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.4

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-111061

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/19/2026

Reference Information

CVE: CVE-2026-111061