Elo compiler sandbox escapes: RCE via .constructor chain and Ruby #{...} interpolation (@enspirit/elo, CVE-2026-44267 / CVE-2026-44266)
Severity: critical · Patch status: patched · Since 2026-11-03 · CVE-2026-44266, CVE-2026-44267
Two critical RCE vulnerabilities (CVE-2026-44267, CVE-2026-44266) were disclosed in the Elo DSL compiler, affecting all versions <= 1.0.0. The JavaScript emitter allows unfiltered .constructor.constructor member access, so an Elo string like ({}).constructor.constructor('…')() compiles to a live Function() call — giving arbitrary Node.js/browser code execution via defaultFormats.elo.parse(), the bin/elo CLI, or a 0-click XSS on the elo-lang.org/try playground (?code=…&run=1). Separately, the Ruby backend fails to escape in emitted double-quoted strings (string literals and subtype-constraint labels), letting {cmd} sequences execute shell commands at runtime. Both were demonstrated with public PoCs including live execution on the production site. Fixed in 1.0.1; both share root causes in transform.ts and compiler escape routines.
What to do
- Upgrade @enspirit/elo to 1.0.1 immediately if you use it as a rule engine, config DSL, or form-builder DSL
- Audit any code path where attacker-controlled strings reach defaultFormats.elo.parse() or Elo CLI invocations (CI/DevOps hosts especially)
- Do not pass untrusted files via bin/elo -f elo or bin/eloc -t ruby -x until patched
- Avoid opening or sharing elo-lang.org/try URLs with ?code= and &run=1 parameters from untrusted sources
- If you embed Elo output in Ruby, review emitted code for interpolation sequences
Fixed versions
Sources
All live incidents on Threat Watch
