Skip to content
OpenAdvisories

Vendor

enspirit

3 known vulnerabilities.

Products

elo 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-44265

    Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields

    Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, …

    enspirit elo @enspirit/elo npm