CVE-2026-44266
CriticalCVSS 9.8Summary
Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.
Risk Assessment
An attacker can execute arbitrary Ruby code and shell commands on hosts using the Ruby backend, leading to system compromise.
Recommendation
Update Elo to version 1.0.1 or later, which properly escapes the # character in emitted Ruby code.
Other vulnerabilities in Elo
See all- CVE-2026-44265High
Elo prior to 1.0.1 has a programmatic AST API that accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. Crafted values become executable expressions or identifiers, allowing arbitrary code execution and SQL injection.
- CVE-2026-44267Critical
Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.
Original NVD description (English source)
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS