{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/elo--1.0.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:elo:elo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-44267"},{"cvss":7.4,"id":"CVE-2026-44265"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-44267\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Elo (\u003c 1.0.1)","Elo (\u003c= 1.0.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Elo"],"content_html":"\u003cp\u003eElo is a purely functional expression language for no-code tools. In versions prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach the JavaScript Function constructor. This is possible because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the property directly, and src/parser.ts accepts constructor as an identifier. The generated JavaScript executes attacker-selected code in the host runtime, permitting browser script execution and session compromise on the playground, and arbitrary Node.js code execution on library, CI, or DevOps hosts. This issue is resolved in version 1.0.1.\u003c/p\u003e\n","date_modified":"2026-11-04T10:15:03Z","date_published":"2026-11-03T20:02:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-elo-cve-2026-44267/","summary":"Elo versions prior to 1.0.1 allow arbitrary code execution because the transformation logic fails to reject .constructor properties in plain string inputs, enabling breakouts into the JavaScript host environment.","title":"Elo: Arbitrary code execution via expression language injection (CVE-2026-44267)","url":"https://feed.craftedsignal.io/briefs/2026-11-elo-cve-2026-44267/"}],"language":"en","title":"CraftedSignal Threat Feed - Elo (\u003c 1.0.1)","version":"https://jsonfeed.org/version/1.1"}