CVE-2026-44266 · GHSA-7w38-ggh5-v542

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Risk score: 74/100
CVSS: 9.8 v3.1
Published: 3 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: The Elo Ruby backend has a remote code execution vulnerability due to unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels. An attacker could execute Ruby code and shell commands through backticks.
Affected: {'products': ['Elo'], 'packages': [{'ecosystem': 'npm', 'name': '@enspirit/elo', 'versions': ['<= 1.0.0']}], 'versions': ['<= 1.0.0']}
Fix: Upgrade to version 1.0.1 or later
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@enspirit/elo: Amber, patch this week. A vulnerability in Elo's JavaScript emitter allows an attacker to execute arbitrary Node.js or browser code via unfiltered `.constructor` member access. This could lead to browser script execution and session compromise, or arbitrary Node.js code execution on hosts.

The flaws

CVE-2026-44266: Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels (CVSS 9.8)
CVE-2026-44267: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access (CVSS 9.8)
CVE-2026-44265: Elo backends have code injection via unvalidated emission of programmatic AST fields (CVSS 7.4)

The fix

Upgrade @enspirit/elo: 1.0.1 or later on your release line

Who is exposed: {'products': ['Elo'], 'packages': [{'ecosystem': 'npm', 'name': '@enspirit/elo', 'versions': ['<= 1.0.0']}]}

Where it stands

Public proof of concept

Connects to

Same weakness: Code injection (CWE-94). 307 other warnings in 30 days

Why it is Amber

CVSS 9.8 critical
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@enspirit/elo	npm	<= 1.0.0	1.0.1

References

Original description

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.

Last activity 3 Nov 2026. Patch Forecast updates every hour.