Skip to content
Threat Feed
Subscribe
critical advisory PoC updated

Elo: Arbitrary code execution via expression language injection (CVE-2026-44267)

Elo versions prior to 1.0.1 allow arbitrary code execution because the transformation logic fails to reject .constructor properties in plain string inputs, enabling breakouts into the JavaScript host environment.

CVE search metadata

CVE search record: CVE-2026-44267. Severity: critical. CVSS: 9.8. KEV: no. Product: Elo (< 1.0.1), Elo (<= 1.0.0). Brief: Elo: Arbitrary code execution via expression language injection (CVE-2026-44267). Brief link: https://feed.craftedsignal.io/briefs/2026-11-elo-cve-2026-44267/

CVE search record: CVE-2026-44265. Severity: high. CVSS: 7.4. KEV: no. Product: Elo (< 1.0.1), Elo (<= 1.0.0). Brief: Elo: Arbitrary code execution via expression language injection (CVE-2026-44267). Brief link: https://feed.craftedsignal.io/briefs/2026-11-elo-cve-2026-44267/

Triage facts

Revision 4
Applicability
Elo (< 1.0.1), Elo (<= 1.0.0)
Evidence
Unknown
Severity
Critical
Sources
4 public sources
Freshness
Revision 4Nov 4, 10:16 UTC
Vulnerabilities
2 CVEs
Source quality
A2Roughly even chance
Revision history 3 entries · Revision 4
  1. Revision 4

    new product

    Changed: affected_products, lastmod, references, updates

    Sources: 1

  2. Revision 3

    added CVE-2026-44265

    Changed: cves, lastmod, priority_signals, references, updates

    Sources: 1

  3. Revision 2

    poc_available

    Changed: claim_state, has_poc, lastmod, poc_references, references, updates

    Sources: 1

Elo is a purely functional expression language for no-code tools. In versions prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach the JavaScript Function constructor. This is possible because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the property directly, and src/parser.ts accepts constructor as an identifier. The generated JavaScript executes attacker-selected code in the host runtime, permitting browser script execution and session compromise on the playground, and arbitrary Node.js code execution on library, CI, or DevOps hosts. This issue is resolved in version 1.0.1.