What is CVE-2026-44267 in Elo?

CVE-2026-44267 is a critical security flaw affecting Elo, a purely functional expression language designed for no-code tools. Specifically, versions prior to 1.0.1 suffer from an evaluation loophole that can be leveraged similarly to other critical issues such as vulnerabilidad crítica CVSS 8.4 or related local risks like escalada de privilegios local sin interacción.

The root cause lies in how plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try handle identifiers. The member_access handler in src/transform.ts fails to reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier.

Who is affected and what are the risks?

The resulting generated JavaScript executes attacker-selected code directly in the host runtime environment, bypassing intended security sandboxes. This risk resembles memory management flaws found in other stacks, including vulnerabilidad use-after-free con CVSS.

This flaw permits browser script execution and session compromise on auto-running playgrounds, alongside arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is completely distinct from any programmatic AST-object injection issues.

How do I secure my systems against this flaw?

Mitigating this vulnerability requires immediate action from developers and system administrators operating environments that ingest untrusted expression strings. Review your dependencies and apply patches immediately.

As detailed in the [[https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5|security advisory on GitHub]], the maintainers have released an official fix. You can also inspect the codebase changes via the [[https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842|commit reference]] or review the [[https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5|additional technical patches]] provided by the [[https://www.cve.org/CVERecord?id=CVE-2026-44267|CVE record]] and the [[https://nvd.nist.gov/vuln/detail/CVE-2026-44267|NVD database]].

  1. Identify all projects utilizing the Elo expression language prior to version 1.0.1.
  2. Update your package dependencies to version 1.0.1 or later using your package manager.
  3. Audit CI/CD pipelines and DevOps nodes to ensure no legacy cached versions are running.
  4. Verify that expression inputs are properly sanitized before parsing.