CVE-2026-44267

Summary

The Elo expression language before 1.0.1 allows remote code execution via plain strings because the parser accepts 'constructor' as an identifier and the JavaScript compiler emits it directly, enabling attackers to invoke .constructor.constructor() to execute arbitrary JavaScript code in the host runtime.

Exploitability

Exploitation is trivial for attackers with network access to affected endpoints (e.g., playground, CLI, or API) since no authentication or user interaction is required and the payload can be a simple string.

Blast radius

In browser-based playgrounds this leads to session hijacking and client-side compromise; in server-side deployments (e.g., CI/DevOps) it enables full remote code execution on the host system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Elo version 1.0.1 or later, which fixes the issue by rejecting meta-properties like 'constructor' in the member_access handler and updating the parser/compiler to prevent unsafe identifier emission.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.