Read the docs
TI-2026-84454 Aliases CVE-2026-44265GHSA-x9rp-7wh3-2rj5

Code injection in Elo via unvalidated programmatic AST fields

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
SQL injection, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89 and CWE-94.

Summary

Elo from 0 before 1.0.1 (the enspirit elo product and the @enspirit/elo npm package) fails to validate values passed to its programmatic AST API. Untyped input such as JSON data or plugin output is interpolated into generated JavaScript, Ruby, Python or SQL without syntax checks (CWE-94). A local attacker with no privileges and no user interaction can craft values that execute arbitrary code in JavaScript, Ruby and Python targets or inject SQL in the SQL target.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.

Why it matters now

EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed elo (enspirit): 1.0.1@enspirit/elo (npm): 1.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
enspiritelobefore 1.0.11.0.1Patch availableCNA
—@enspirit/elo (npm)before 1.0.11.0.1Patch availableGHSA-x9rp-7wh3-2rj5
  • elo Vendorenspirit Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
  • @enspirit/elo (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-x9rp-7wh3-2rj5

Remediation

Upgrade Elo to version 1.0.1, which fixes the enspirit elo product and the @enspirit/elo npm package.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA elo (enspirit) Fixed in 1.0.1
  • Fix · GHSA-x9rp-7wh3-2rj5 @enspirit/elo (npm) Fixed in 1.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-44265
  2. 2026-11-03 Alias added: GHSA-x9rp-7wh3-2rj5
  3. 2026-11-03 Fix available: npm/@enspirit/[email protected] · GHSA-x9rp-7wh3-2rj5
  4. 2026-11-03 CVSS score added · GHSA-x9rp-7wh3-2rj5
  5. 2026-11-03 Weakness changed · GHSA-x9rp-7wh3-2rj5
  6. 2026-11-03 4 new references · GHSA-x9rp-7wh3-2rj5
  7. 2026-11-05 Priority changed: MEDIUM → LOW
  8. 2026-11-06 Affected versions changed · Red Hat
  9. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-84456 Sandbox escape in Elo JavaScript emitter allows arbitrary code execution CVSS 3.1CRITICAL 9.8
  • TI-2026-84455 Remote code execution in Elo Ruby backend via unescaped interpolation CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences