CVE-2026-44266

Summary

The Ruby backend in Elo prior to 1.0.1 embeds unescaped attacker-controlled input into double-quoted Ruby strings, enabling code injection via string interpolation (#) or backtick command execution when compiled Ruby runs.

Exploitability

Exploitation requires sending malicious input to the Ruby-targeted /try playground, bin/eloc -t ruby -x, or parse+emit pipeline; no authentication or user interaction is needed (CVSS AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation grants full remote code execution with the privileges of the Ruby interpreter, compromising confidentiality, integrity, and availability of the host system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Elo version 1.0.1 or later, which fixes the unescaped # handling in Ruby string-literal emission.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.