{"affected":[{"product":"elo","source":"CNA: GitHub_M","vendor":"enspirit","versions":[{"status":"affected","version":"< 1.0.1"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@enspirit/elo","product":"@enspirit/elo","source":"OSV GHSA-33r5-xmm8-v6x5","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"1.0.1"}],"lessThan":"1.0.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-44267","cwes":["CWE-79","CWE-94","CWE-693","CWE-1336"],"description":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793728945925,"publishedAt":1793728345509,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-33r5-xmm8-v6x5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-33r5-xmm8-v6x5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-33r5-xmm8-v6x5","text":"@enspirit/elo (npm): OSV reports a fixed version 1.0.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-33r5-xmm8-v6x5"}],"revision":"d86e441d02e84b52f3ac58d92184989e1dcefbdbfc73909f9936efd8916d17f3","sources":[{"modifiedAt":1793728345509,"name":"CNA: GitHub_M","retrievedAt":1793729431589,"url":"https://www.cve.org/CVERecord?id=CVE-2026-44267"},{"modifiedAt":1793728945925,"name":"OSV / GitHub Security Advisories","retrievedAt":1793729432735,"url":"https://osv.dev/vulnerability/GHSA-33r5-xmm8-v6x5"}],"ssvc":null,"status":"published","title":"Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter","updatedAt":1793729432735}