x/vulndb: potential Go vuln in github.com/elves/elvish: GHSA-fpv6-f8jw-rc3r

[GoVulnBot]

In GitHub Security Advisory GHSA-fpv6-f8jw-rc3r, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/elves/elvish	0.14.0	< 0.14.0

Cross references:

• CVE-2021-41088 appears in issue x/vulndb: potential Go vuln in github.com/elves/elvish: CVE-2021-41088, GHSA-fpv6-f8jw-rc3r #937 NOT_IMPORTABLE
• GHSA-fpv6-f8jw-rc3r appears in issue x/vulndb: potential Go vuln in github.com/elves/elvish: CVE-2021-41088, GHSA-fpv6-f8jw-rc3r #937 NOT_IMPORTABLE
• Module github.com/elves/elvish appears in issue x/vulndb: potential Go vuln in github.com/elves/elvish: CVE-2021-41088, GHSA-fpv6-f8jw-rc3r #937 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/elves/elvish
    versions:
      - fixed: 0.14.0
    packages:
      - package: github.com/elves/elvish
description: |-
    ### Impact

    Elvish's backend for the experimental web UI (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.

    The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

    ### Patches

    All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

    The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

    ### Workarounds

    Do not use the experimental web UI.

    ### For more information

    If you have any questions or comments about this advisory, please email [email protected].
cves:
  - CVE-2021-41088
ghsas:
  - GHSA-fpv6-f8jw-rc3r

[tatianab]

Duplicate of #937