{"id":"CVE-2026-44267","published":"2026-11-03T18:18:03.130","lastModified":"2026-11-03T18:18:03.130","description":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-79","CWE-94","CWE-693","CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842","tags":[]},{"url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","tags":[]},{"url":"https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5","tags":[]}],"exploitRefs":[{"url":"https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842","tags":[]},{"url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","tags":[]},{"url":"https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5","tags":[]}],"hasPoc":true,"ai":{"summary":"The Elo expression language before 1.0.1 allows remote code execution via plain strings because the parser accepts 'constructor' as an identifier and the JavaScript compiler emits it directly, enabling attackers to invoke .constructor.constructor() to execute arbitrary JavaScript code in the host runtime.","exploitability":"Exploitation is trivial for attackers with network access to affected endpoints (e.g., playground, CLI, or API) since no authentication or user interaction is required and the payload can be a simple string.","blast_radius":"In browser-based playgrounds this leads to session hijacking and client-side compromise; in server-side deployments (e.g., CI/DevOps) it enables full remote code execution on the host system.","remediation":"Upgrade to Elo version 1.0.1 or later, which fixes the issue by rejecting meta-properties like 'constructor' in the member_access handler and updating the parser/compiler to prevent unsafe identifier emission.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","no-code","injection"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:48:37.765Z"}}