CVE-2026-44267
CriticalCVSS 9.8Summary
Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.
Risk Assessment
An attacker can compromise user sessions in the playground or execute arbitrary code on library, CI, and DevOps hosts, leading to system compromise.
Recommendation
Update Elo to version 1.0.1 or later, which rejects meta-properties in the member_access handler.
Other vulnerabilities in Elo
See all- CVE-2026-44265High
Elo prior to 1.0.1 has a programmatic AST API that accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. Crafted values become executable expressions or identifiers, allowing arbitrary code execution and SQL injection.
- CVE-2026-44266Critical
Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.
Original NVD description (English source)
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS