Detections
Analytics

Chainguard: yazi: security update to 26.9.1-r7

high Tenable Cloud Security Plugin ID 478144

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From
 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in
 russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful
 result instead of calling Agent::confirm. In applications that override Agent::confirm to require user
 approval or another policy check, a process that can reach the agent socket, including the remote side of
 a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign
 data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for
 every signing request, so checks implemented there remain effective, and implementations that retain the
 default always-successful Agent::confirm do not lose an approval check through this regression. This issue
 is fixed in version 0.65.0. (CVE-2026-116794)

Solution

Update the yazi library and its related packages to version 26.9.1-r7 or later.

Plugin Details

Severity: High

ID: 478144

Version: Revision 1.1

Type: Local

Published: 11/1/2026

Updated: 11/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.57

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-116794

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 5.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/28/2026

Reference Information

CVE: CVE-2026-116794