# CVE-2026-44266: Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Status: published. Published: 2026-11-03. Updated: 2026-11-03.

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.

## Remediation

- fix: @enspirit/elo (npm): OSV reports a fixed version 1.0.1. Check the advisory for supported release branches. (source: OSV GHSA-7w38-ggh5-v542) — https://github.com/advisories/GHSA-7w38-ggh5-v542

## Affected products and versions

- enspirit / elo: < 1.0.1 (affected). Source: CNA: GitHub_M
-  / @enspirit/elo (@enspirit/elo): ≥ 0; < 1.0.1 (affected, semver); OSV events: introduced 0; fixed 1.0.1. Source: OSV GHSA-7w38-ggh5-v542

## Severity and prioritization

- CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-94, CWE-116, CWE-1336

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-7w38-ggh5-v542 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-7w38-ggh5-v542 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-44266; retrieved 2026-11-03; source updated 2026-11-03

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-7w38-ggh5-v542; retrieved 2026-11-03; source updated 2026-11-03

Revision: fc8e5953a02ccf975aa610bb17c0987d7bf0f852f17fc08b7d6648e1e7a04f5c

Canonical: https://y2.dev/cve/CVE-2026-44266

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.