Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
Affects Elo up to 1.0.0 when the programmatic AST API is fed untyped input without runtime validation. CVSS rates it high (7.4). Fixed in 1.0.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.0.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Integrator populates the Elo programmatic AST from untyped input such as JSON-deserialised data or plugin output Affected Elo versions are those using the programmatic AST API without runtime validation at emit sites (affected versions up to 1.0.0)
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach10/20Affects npm packages
- Severity7.4/10CVSS 7.4
- No patch0/5No signal
What would change the score
- Would score about 72 if added to CISA KEV
- Would score about 67 if CISA's SSVC rates exploitation active
- Would score about 32 if CISA's SSVC rates it automatable
CVE-2026-44265 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects elo; fixed in 1.0.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Elo, a purely functional expression language used in no-code tools, is affected in versions before 1.0.1 through its programmatic AST API, which can generate code in JavaScript, Ruby, Python, and SQL. Attackers who can supply crafted values to this API could run arbitrary code or inject SQL, potentially taking control of the affected backend.
Read the original description
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.
Impact
- Widely used
@enspirit/elo has 757 weekly downloads.Source: npmjs.com
What to do
Check whether your setup matches what the bug needs.
Integrator populates the Elo programmatic AST from untyped input such as JSON-deserialised data or plugin output Affected Elo versions are those using the programmatic AST API without runtime validation at emit sites (affected versions up to 1.0.0)Upgrade to a fixed version: 1.0.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- enspirit elo
fixed in 1.0.1
- @enspirit/elonpm
fixed in 1.0.1
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-44265
Is CVE-2026-44265 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax checks, so those values can be emitted into generated code. In the JavaScript, Ruby and Python targets this allows arbitrary code execution, and in the SQL target it allows SQL injection.Source: github.com, github.com
Which versions are affected by CVE-2026-44265?
elo: before 1.0.1. @enspirit/elo (npm): before 1.0.1.Source: cve.now feed data
Am I affected, and how do I check?
Versions up to 1.0.0 of @enspirit/elo are affected when the AST is built from untyped sources, such as JSON-deserialised data or plugin output, without runtime validation. To check the installed version, run npm ls @enspirit/elo in the project directory.Source: github.com, github.com
How do I fix CVE-2026-44265?
Upgrade @enspirit/elo to 1.0.1, the fixed version named in the release.Source: github.com, github.com