CVE-2026-44265 · GHSA-x9rp-7wh3-2rj5

Elo backends have code injection via unvalidated emission of programmatic AST fields

Risk score: 54/100
CVSS: 7.4 v3.1
Published: 3 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affect…
Affected: @enspirit/elo (npm) <= 1.0.0
Fix: Upgrade @enspirit/elo to 1.0.1 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@enspirit/elo: Amber, patch this week. A vulnerability in Elo's JavaScript emitter allows an attacker to execute arbitrary Node.js or browser code via unfiltered `.constructor` member access. This could lead to browser script execution and session compromise, or arbitrary Node.js code execution on hosts.

The flaws

CVE-2026-44265: Elo backends have code injection via unvalidated emission of programmatic AST fields (CVSS 7.4)
CVE-2026-44267: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access (CVSS 9.8)
CVE-2026-44266: Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels (CVSS 9.8)

The fix

Upgrade @enspirit/elo: 1.0.1 or later on your release line

Who is exposed: {'products': ['Elo'], 'packages': [{'ecosystem': 'npm', 'name': '@enspirit/elo', 'versions': ['<= 1.0.0']}]}

Where it stands

Public proof of concept

Connects to

Same weakness: SQL injection (CWE-89). 400 other warnings in 30 days

Why it is Yellow

CVSS 7.4 high
Public exploit or proof of concept referenced
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@enspirit/elo	npm	<= 1.0.0	1.0.1

References

Original description

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.

Last activity 3 Nov 2026. Patch Forecast updates every hour.