Is CVE-2026-44266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44266 being exploited in the wild.

How severe is CVE-2026-44266?

Critical severity, with a CVSS score of 9.8, published 3 November 2026.

Which products and versions are affected?

Elo Ruby backend all versions prior to fix; @enspirit/elo (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.0.1.

Is there a fix for CVE-2026-44266?

Yes. @enspirit/elo (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44266 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44266?

Check whether you run Elo Ruby backend or @enspirit/elo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44266: Elo Ruby backend remote code execution via unescaped string interpolation

Q: Is there a fix for CVE-2026-44266?

Yes. @enspirit/elo (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44266 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44266?

Check whether you run Elo Ruby backend or @enspirit/elo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44266 · Severity: critical · CVSS 9.8 · Published 2026-11-03

Elo is a cross-platform domain-specific language for building data validators and forms. The Ruby code generator fails to escape special characters when converting Elo code into Ruby, allowing attackers to inject arbitrary Ruby code—including shell commands via backticks—into compiled programs. Any organization using Elo's web playground, CLI, or as a library for validation or configuration is at risk of remote code execution.

Technologies: @enspirit/elo (npm). Vendors: npm.

Quick answers

Is CVE-2026-44266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44266 being exploited in the wild.
How severe is CVE-2026-44266?: Critical severity, with a CVSS score of 9.8, published 3 November 2026.
Which products and versions are affected?: Elo Ruby backend all versions prior to fix; @enspirit/elo (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.0.1.
Is there a fix for CVE-2026-44266?: Yes. @enspirit/elo (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44266 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44266?: Check whether you run Elo Ruby backend or @enspirit/elo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@enspirit/elo (npm): upgrade to 1.0.1 or later
```
npm install @enspirit/elo@1.0.1
```

Technical details

The Ruby emitter in src/compilers/ruby.ts omits escaping of the `#` character in double-quoted strings, enabling interpolation sequences such as `#{...}` to execute arbitrary expressions. Two sinks are vulnerable: string literals (lines 180–184) and subtype-constraint error labels (lines 405–412). An attacker can craft Elo source code containing `#{`backtick-command`}` sequences that compile to executable Ruby code; the backticks execute arbitrary shell commands at runtime with the privileges of the Elo runtime process.

Affected products

Elo Elo Ruby backend all versions prior to fix

Identifiers

CVE-2026-44266
GHSA-7w38-ggh5-v542

Timeline

2026-11-03: disclosed: Advisory published
2026-11-03: advisory: CVE-2026-44266

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.