# CVE-2026-44267: Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse()

Source: https://junglewise.ai/threats/cve-2026-44267-elo-javascript-emitter-has-sandbox-escape-to-arbitrary-node-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-44267 · Severity: critical · CVSS 9.8 · Published 2026-11-03

Elo is a safe data and domain-specific language that compiles to JavaScript. An attacker who controls any string input to Elo's parser—through a browser playground, command-line tool, or library API—can escape the sandbox and execute arbitrary Node.js or browser code by chaining `.constructor.constructor` to invoke JavaScript's Function constructor. This affects all three entry points: compromising visitor sessions on the live elo-lang.org website, executing commands on CI/DevOps systems, and enabling remote code execution in any application using Elo as a rule engine or configuration parser.

Technologies: [@enspirit/elo (npm)](https://junglewise.ai/threats/technologies/enspirit-elo). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44267 being exploited in the wild.

**How severe is CVE-2026-44267?** Critical severity, with a CVSS score of 9.8, published 3 November 2026.

**Which products and versions are affected?** Elo prior to fix; @enspirit/elo (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.0.1.

**Is there a fix for CVE-2026-44267?** Yes. @enspirit/elo (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44267 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-44267?** Check whether you run Elo or @enspirit/elo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @enspirit/elo (npm): upgrade to 1.0.1 or later

  ```sh
  npm install @enspirit/elo@1.0.1
  ```


## Technical details

The vulnerability stems from three interacting design flaws in Elo's JavaScript compiler: (1) the transform stage's member_access handler does not filter property names on member access expressions, (2) the JavaScript emitter writes property names verbatim into output without escaping, and (3) the parser accepts `constructor` and other JavaScript meta-property names as ordinary identifiers without validation. An unauthenticated attacker supplying the expression `({}).constructor.constructor('malicious code')()` bypasses all three layers and compiles to a live Function invocation in the target runtime, enabling arbitrary code execution in Node.js (when using the CLI or library API) or the browser (when using the playground).

## Affected products

- Elo Elo prior to fix

## Identifiers

- CVE-2026-44267
- GHSA-33r5-xmm8-v6x5

## Timeline

- 2026-11-03: disclosed

## Related threats

- [Elo Ruby backend remote code execution via unescaped string interpolation](https://junglewise.ai/threats/cve-2026-44266-elo-ruby-backend-has-remote-code-execution-via-unescaped)
- [Elo code injection via unvalidated AST fields](https://junglewise.ai/threats/cve-2026-44265-elo-backends-have-code-injection-via-unvalidated-emission-of)