enspirit/elo Security Advisories | GitStock

critical2026-11-03

CVE-2026-44267-Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

GHSA-33r5-xmm8-v6x5

critical2026-11-03

CVE-2026-44266-Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

GHSA-7w38-ggh5-v542

high2026-11-03

CVE-2026-44265-Elo backends have code injection via unvalidated emission of programmatic AST fields

GHSA-x9rp-7wh3-2rj5