@enspirit/elo vulnerabilities and fixes
Exploited and high-severity @enspirit/elo vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 9.8CVE-2026-44267Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accessFix available@enspirit/elo
2 min read - 9.8CVE-2026-44266Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsRCEFix available@enspirit/elo
2 min read - 7.4CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsRCEFix availableenspirit elo
1 min read