Skip to content
OpenAdvisories

Vendor

enspirit

3 known vulnerabilities.

Products

elo 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-44267 Public exploit

    Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

    Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access ha…

    enspirit elo @enspirit/elo npm
  • Critical 9.8
    CVE-2026-44266

    Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

    Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emi…

    enspirit elo @enspirit/elo npm