Answer in brief
CVE-2026-44267 records a Critical severity (CVSS 9.8) vulnerability in Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter. The current sources do not mark it as known exploited. The current feed maps enspirit/elo (generic), @enspirit/elo (npm), @enspirit/elo (npm), @enspirit/elo (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps enspirit/elo (generic), @enspirit/elo (npm), @enspirit/elo (npm), @enspirit/elo (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| enspirit/elogeneric | <1.0.1 | 1.0.1 |
| @enspirit/elonpm | <=1.0.0 | 1.0.1 |
| @enspirit/elonpm | >=0 <1.0.1 | 1.0.1 |
| @enspirit/elonpm | <=1.0.0 | 1.0.1 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Quoted source text, attributed separately from HOL analysis.