Vendor
Elo versions prior to 1.0.1 are vulnerable to arbitrary code execution in the Ruby backend due to improper escaping of input within Ruby double-quoted strings.