https://feed.craftedsignal.io/cpes/cpe2.3aeloelo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:02:20 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-elo-cve-2026-44267/Tue, 03 Nov 2026 20:02:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-elo-cve-2026-44267/Elo versions prior to 1.0.1 allow arbitrary code execution because the transformation logic fails to reject .constructor properties in plain string inputs, enabling breakouts into the JavaScript host environment.<p>Elo is a purely functional expression language for no-code tools. In versions prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach the JavaScript Function constructor. This is possible because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the property directly, and src/parser.ts accepts constructor as an identifier. The generated JavaScript executes attacker-selected code in the host runtime, permitting browser script execution and session compromise on the playground, and arbitrary Node.js code execution on library, CI, or DevOps hosts. This issue is resolved in version 1.0.1.</p> criticaladvisory