CVE-2021-41088

Name: CVE-2021-41088
Creator: NVD / NIST
Published: 2021-09-23T20:15:07.72+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.52%

Last modified Jun 17, 2026

CVE-2021-41088 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. EPSS estimates a 0.52% chance of exploitation in the next 30 days.

Description

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

0.52%

40.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Elv	Elvish	< 0.14.0

References

https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5Patch, Third Party Advisory
https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3rThird Party Advisory
https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5Patch, Third Party Advisory
https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3rThird Party Advisory

Timeline

Published: Sep 23, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-41088?

How severe is CVE-2021-41088?

CVE-2021-41088 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.52% probability of exploitation in the next 30 days.

How do I fix CVE-2021-41088?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-41088?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST