ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-44267

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered member access

Published Nov 3, 2026 · catalog updated Nov 3, 2026 · Elo JavaScript emitter has

Last checked Nov 8, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-44267. EPSS is 0.83%. Act only if a listed version of Elo JavaScript emitter has is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Elo JavaScript emitter has).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.83%
Remediation
Version ranges on file
Affected products
npm @enspirit · npm @enspirit/elo

### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — , the CLI, or the live browser playground at — can execute arbitrary code in the host JavaScript runtime. A payload built from the chain compiles, without modification, to a live invocation in the emitted JavaScript, escaping any sandbox assumption around "Elo is a safe data/DSL language." ### Vulnerable sink and root cause Three interacting sites in produce the bug at commit : 1. ** ** — the handler allows access on types , , or without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. ** ** — the JS emitter writes verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. ** ** — the parser accepts (and other JS meta-property names) as an ordinary identifier, so clears type-checking without triggering any warning. Combined, the Elo expression compiles to a live call in the emitted JS, executing in the realm of whichever sink runs the compiled code. ### Attack surfaces All three surfaces share the same root cause (no denylist in ) and are addressed by the same one-file patch: | # | Entry point | Threat model | |---|---|---| | 1 | Browser playground — | **0-click XSS / account takeover** against elo-lang.org. triggers in ; the server issues a 301 that preserves . Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. | | 2 | CLI | **RCE on CI / DevOps hosts.** Both and fire. The path is especially severe: the flag exists to pass user-supplied files as *data* into an Elo pipeline. No integrator expects a data-format flag to shell out to . | | 3 | Library API — | **Node.js RCE for any downstream integrator** using Elo as a rule engine, configuration DSL, or form builder DSL (the primary documented use cases). | ### Proof of Concept **Common payload (works on all three entry points):** **Library API** — : **CLI** — :

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @enspiritversion unspecified
  • npm @enspirit/elo<= 1.0.0

How to fix CVE-2026-44267

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-44267. EPSS is 0.83%. Act only if a listed version of Elo JavaScript emitter has is installed.

Which versions are affected?

Compare what you have installed with <= 1.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine; CWE-693: Protection Mechanism Failure; CWE-79: Cross-site Scripting (XSS). EPSS 0.83%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 3, 2026 · GitHub Advisory Database

    Detected

    ### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — , the CLI, or the live browser playground at — can execute arbitrary code in the host JavaScript runtime. A payload built from the chain compiles, without modification, to a live invocation in the emitted JavaScript, escaping any sandbox assumption around "Elo is a safe data/DSL language." ##

  2. Nov 3, 2026 · GitHub Advisory Database

    Updated

    ### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — , the CLI, or the live browser playground at — can execute arbitrary code in the host JavaScript runtime. A payload built from the chain compiles, without modification, to a live invocation in the emitted JavaScript, escaping any sandbox assumption around "Elo is a safe data/DSL language." ##

Sources

  • CVE.orgVulnerability recordCVE-2026-44267

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-33r5-xmm8-v6x5

    Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered member access

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-44267

    An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — defaultFormats.elo.parse(), the bin/elo CLI, or the live browser playground at elo-lang.org/try — can execute arbitrary code in the host JavaScript runtime. A payload built from the .constructor.constructor chain compiles, without modification, to a live Function invocation in the emitted JavaScript, esc

    advisories.gitlab.com
  • Tenable CVE DatabaseVulnerability recordCVE-2026-44267

    Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.

    tenable.com

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 8, 2026
  • Tenable CVE DatabaseNov 7, 2026
  • GitHub Advisory DatabaseNov 7, 2026
  • CVE.orgNov 4, 2026