npmPackage

@enspirit/elo

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-44267Critical 9.8
Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Affected: fixed in 1.0.1.
Fixed in 1.0.1 (released Apr 20, 2026, 197 days before disclosure).
The latest release, 1.2.4, is not affected.
13% of @enspirit/elo downloads last week were affected versions (321).
CVE-2026-44266Critical 9.8
Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Affected: fixed in 1.0.1.
Fixed in 1.0.1 (released Apr 20, 2026, 197 days before disclosure).
The latest release, 1.2.4, is not affected.
13% of @enspirit/elo downloads last week were affected versions (321).
CVE-2026-44265High 7.4
Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
Affected: fixed in 1.0.1.
Fixed in 1.0.1 (released Apr 20, 2026, 197 days before disclosure).
The latest release, 1.2.4, is not affected.
13% of @enspirit/elo downloads last week were affected versions (321).