https://feed.craftedsignal.io/vendors/enspirit/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:02:10 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-elo-ruby-code-injection/Tue, 03 Nov 2026 20:02:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-elo-ruby-code-injection/Elo versions prior to 1.0.1 are vulnerable to arbitrary code execution in the Ruby backend due to improper escaping of input within Ruby double-quoted strings.<p>Elo, a functional expression language, contains a vulnerability in its Ruby backend (src/compilers/ruby.ts). Attacker-controlled text is embedded into Ruby double-quoted strings without escaping '#', allowing Ruby interpolation to become executable. A failing labelled subtype constraint or an ordinary string literal can lead to Ruby code and shell command execution via backticks. Affected entry points include the /try playground (Ruby target), bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. This issue is fixed in version 1.0.1.</p> criticaladvisory