Search
Find a vulnerability
Search criteria
6 vulnerabilities by enspirit
CVE-2026-44267 (GCVE-0-2026-44267)
Vulnerability from nvd – Published: 2026-11-03 17:52 – Updated: 2026-11-03 17:52
VLAI
EPSS
VEX
Title
Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Summary
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Severity
9.8 (Critical)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/enspirit/elo/security/advisori… | x_refsource_CONFIRM |
| https://github.com/enspirit/elo/commit/2136da1f64… | x_refsource_MISC |
| https://github.com/enspirit/elo/commit/d2a89a8db7… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "elo",
"vendor": "enspirit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:52:25.509Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5"
},
{
"name": "https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842"
},
{
"name": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"
}
],
"source": {
"advisory": "GHSA-33r5-xmm8-v6x5",
"discovery": "UNKNOWN"
},
"title": "Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44267",
"datePublished": "2026-11-03T17:52:25.509Z",
"dateReserved": "2026-05-05T16:33:55.845Z",
"dateUpdated": "2026-11-03T17:52:25.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44266 (GCVE-0-2026-44266)
Vulnerability from nvd – Published: 2026-11-03 17:51 – Updated: 2026-11-03 19:39
VLAI
EPSS
VEX
Title
Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Summary
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:38 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/enspirit/elo/security/advisori… | x_refsource_CONFIRM |
| https://github.com/enspirit/elo/commit/51b869963f… | x_refsource_MISC |
| https://github.com/enspirit/elo/commit/d2a89a8db7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44266",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:38:47.531162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:39:09.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "elo",
"vendor": "enspirit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:51:12.013Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542"
},
{
"name": "https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38"
},
{
"name": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"
}
],
"source": {
"advisory": "GHSA-7w38-ggh5-v542",
"discovery": "UNKNOWN"
},
"title": "Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44266",
"datePublished": "2026-11-03T17:51:12.013Z",
"dateReserved": "2026-05-05T16:33:55.845Z",
"dateUpdated": "2026-11-03T19:39:09.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44265 (GCVE-0-2026-44265)
Vulnerability from nvd – Published: 2026-11-03 17:47 – Updated: 2026-11-03 17:47
VLAI
EPSS
VEX
Title
Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
Summary
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.
Severity
7.4 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/enspirit/elo/security/advisori… | x_refsource_CONFIRM |
| https://github.com/enspirit/elo/commit/d2a89a8db7… | x_refsource_MISC |
| https://github.com/enspirit/elo/commit/fb57dd37a2… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "elo",
"vendor": "enspirit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo\u0027s programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:47:03.347Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"
},
{
"name": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"
},
{
"name": "https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93"
}
],
"source": {
"advisory": "GHSA-x9rp-7wh3-2rj5",
"discovery": "UNKNOWN"
},
"title": "Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44265",
"datePublished": "2026-11-03T17:47:03.347Z",
"dateReserved": "2026-05-05T16:33:55.845Z",
"dateUpdated": "2026-11-03T17:47:03.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44267 (GCVE-0-2026-44267)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:52 – Updated: 2026-11-03 17:52
VLAI
EPSS
VEX
Title
Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Summary
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Severity
9.8 (Critical)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/enspirit/elo/security/advisori… | x_refsource_CONFIRM |
| https://github.com/enspirit/elo/commit/2136da1f64… | x_refsource_MISC |
| https://github.com/enspirit/elo/commit/d2a89a8db7… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "elo",
"vendor": "enspirit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:52:25.509Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5"
},
{
"name": "https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842"
},
{
"name": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"
}
],
"source": {
"advisory": "GHSA-33r5-xmm8-v6x5",
"discovery": "UNKNOWN"
},
"title": "Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44267",
"datePublished": "2026-11-03T17:52:25.509Z",
"dateReserved": "2026-05-05T16:33:55.845Z",
"dateUpdated": "2026-11-03T17:52:25.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44266 (GCVE-0-2026-44266)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:51 – Updated: 2026-11-03 19:39
VLAI
EPSS
VEX
Title
Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Summary
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:38 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/enspirit/elo/security/advisori… | x_refsource_CONFIRM |
| https://github.com/enspirit/elo/commit/51b869963f… | x_refsource_MISC |
| https://github.com/enspirit/elo/commit/d2a89a8db7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44266",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:38:47.531162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:39:09.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "elo",
"vendor": "enspirit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:51:12.013Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542"
},
{
"name": "https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38"
},
{
"name": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"
}
],
"source": {
"advisory": "GHSA-7w38-ggh5-v542",
"discovery": "UNKNOWN"
},
"title": "Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44266",
"datePublished": "2026-11-03T17:51:12.013Z",
"dateReserved": "2026-05-05T16:33:55.845Z",
"dateUpdated": "2026-11-03T19:39:09.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44265 (GCVE-0-2026-44265)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:47 – Updated: 2026-11-03 17:47
VLAI
EPSS
VEX
Title
Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
Summary
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.
Severity
7.4 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/enspirit/elo/security/advisori… | x_refsource_CONFIRM |
| https://github.com/enspirit/elo/commit/d2a89a8db7… | x_refsource_MISC |
| https://github.com/enspirit/elo/commit/fb57dd37a2… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "elo",
"vendor": "enspirit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo\u0027s programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:47:03.347Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"
},
{
"name": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"
},
{
"name": "https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93"
}
],
"source": {
"advisory": "GHSA-x9rp-7wh3-2rj5",
"discovery": "UNKNOWN"
},
"title": "Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44265",
"datePublished": "2026-11-03T17:47:03.347Z",
"dateReserved": "2026-05-05T16:33:55.845Z",
"dateUpdated": "2026-11-03T17:47:03.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}