Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVEs enspirit elo 1.0.1 fixes 2 critical CVEs Worst: remote code execution in Ruby compilation backend (CVE-2026-44266) Patch → 1.0.1 https://cve.now/CVE-2026-44266?release=CVE-2026-44267&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
🔴 Elo, Remote Code Execution, #CVE-2026-44267 (Critical) -DC-Nov2026-4152 https://dailycve.com/elo-remote-code-execution-cve-2026-44267-critical-dc-nov2026-4152/
CVE-2026-44267 Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or https://elo-lang.org/t… https://www.cve.org/CVERecord?id=CVE-2026-44267