CVE-2026-44265
HighCVSS 7.4Summary
Elo prior to 1.0.1 has a programmatic AST API that accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. Crafted values become executable expressions or identifiers, allowing arbitrary code execution and SQL injection.
Risk Assessment
An attacker can execute arbitrary code in JavaScript, Ruby, and Python targets and perform SQL injection in the SQL target, leading to system and database compromise.
Recommendation
Update Elo to version 1.0.1 or later, which validates AST values before interpolation into generated code.
Other vulnerabilities in Elo
See all- CVE-2026-44267Critical
Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.
- CVE-2026-44266Critical
Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.
Original NVD description (English source)
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS