CVE-2026-44267 debrief: The Elo JavaScript emitter has a sandbox escape vulnerability via unfiltered `.constructor` member access, allowing an unauthenticated attacker to execute arbitrary code in the host JavaScript runtime. This vulnerability affects @enspirit/elo, particularly in scenarios with untrusted input. Developers and administrators should assess exposure and prioritize remediation to prevent p [truncated]
The Elo Ruby backend is vulnerable to Remote Code Execution due to unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels. This allows an attacker to inject and execute arbitrary Ruby code, potentially leading to shell command execution. The vulnerability exists in the string-literal emitter and labelled subtype-constraint branch of the Elo Ruby backend, specifically in [truncated]
The CVE record describes a code injection vulnerability in Elo backends due to unvalidated emission of programmatic AST fields. The vulnerability allows an integrator to expose a code-injection primitive that flows through to the emitted JavaScript, Ruby, Python, or SQL. This issue arises from the lack of runtime type or syntax validation in Elo's programmatic AST API, which accepts arbitrary values in ma [truncated]
