CVE-2021-41088

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

• CWE-668
• CWE-346

• https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5Patch, Third Party Advisory
• https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3rThird Party Advisory
• https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5Patch, Third Party Advisory
• https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3rThird Party Advisory

Published

Sep 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41082Discourse is a platform for community discussion. In affecte…7.5
• CVE-2021-41083Dada Mail is a web-based e-mail list management system. In a…8.8
• CVE-2021-41084http4s is an open source scala interface for HTTP. In affect…4.7
• CVE-2021-41086jsuites is an open source collection of common required java…5.4
• CVE-2021-41087in-toto-golang is a go implementation of the in-toto framewo…6.5
• CVE-2021-41089Moby is an open-source project created by Docker to enable s…6.3
• CVE-2021-41090Grafana Agent is a telemetry collector for sending metrics, …7.5
• CVE-2021-41091Moby is an open-source project created by Docker to enable s…6.3
• CVE-2021-41092Docker CLI is the command line interface for the docker cont…7.5
• CVE-2021-41093Wire is an open source secure messenger. In affected version…9.8
• CVE-2021-41094Wire is an open source secure messenger. Users of Wire by Bu…4.6