CVE-2026-44267: Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse()

CVE-2026-44267 · Severity: critical · CVSS 9.8 · Published 2026-11-03

Elo is a safe data and domain-specific language that compiles to JavaScript. An attacker who controls any string input to Elo's parser—through a browser playground, command-line tool, or library API—can escape the sandbox and execute arbitrary Node.js or browser code by chaining `.constructor.constructor` to invoke JavaScript's Function constructor. This affects all three entry points: compromising visitor sessions on the live elo-lang.org website, executing commands on CI/DevOps systems, and enabling remote code execution in any application using Elo as a rule engine or configuration parser.

Technologies: @enspirit/elo (npm). Vendors: npm.

Quick answers

Is CVE-2026-44267 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44267 being exploited in the wild.
How severe is CVE-2026-44267?
Critical severity, with a CVSS score of 9.8, published 3 November 2026.
Which products and versions are affected?
Elo prior to fix; @enspirit/elo (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.0.1.
Is there a fix for CVE-2026-44267?
Yes. @enspirit/elo (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44267 attacked?
It is attacked over the network.
Am I affected by CVE-2026-44267?
Check whether you run Elo or @enspirit/elo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @enspirit/elo (npm): upgrade to 1.0.1 or later
    npm install @enspirit/elo@1.0.1

Technical details

The vulnerability stems from three interacting design flaws in Elo's JavaScript compiler: (1) the transform stage's member_access handler does not filter property names on member access expressions, (2) the JavaScript emitter writes property names verbatim into output without escaping, and (3) the parser accepts `constructor` and other JavaScript meta-property names as ordinary identifiers without validation. An unauthenticated attacker supplying the expression `({}).constructor.constructor('malicious code')()` bypasses all three layers and compiles to a live Function invocation in the target runtime, enabling arbitrary code execution in Node.js (when using the CLI or library API) or the browser (when using the playground).

Affected products

  • Elo Elo prior to fix

Identifiers

  • CVE-2026-44267
  • GHSA-33r5-xmm8-v6x5

Timeline

  • 2026-11-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.