https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 05:10:05 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-44267 <p>Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.</p> <p>Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-44267 https://db.gcve.eu/vuln/ghsa-33r5-xmm8-v6x5 <p><strong>Affected:</strong> npm: @enspirit/elo</p> <p>### Summary</p> <p>An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around &#34;Elo is a safe data/DSL language.&#34;</p> <p>### Vulnerable sink and root cause</p> <p>Three interacting sites in `src/` produce the bug at commit `749af7b`:</p> <p>1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning.</p> <p>Combined, the Elo expression `({}).constructor.constructor(&#39;…&#39;)()` compiles to a live `Function(&#39;…&#39;)()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code.</p> <p>### Attack surfaces</p> <p>All three surfaces share the same r…</p> <p><strong>Affected:</strong> npm: @enspirit/elo</p> <p>### Summary</p> <p>An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around &#34;Elo is a safe data/DSL language.&#34;</p> <p>### Vulnerable sink and root cause</p> <p>Three interacting sites in `src/` produce the bug at commit `749af7b`:</p> <p>1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning.</p> <p>Combined, the Elo expression `({}).constructor.constructor(&#39;…&#39;)()` compiles to a live `Function(&#39;…&#39;)()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code.</p> <p>### Attack surfaces</p> <p>All three surfaces share the same r…</p> https://db.gcve.eu/vuln/ghsa-33r5-xmm8-v6x5