elo Code Execution Flaw: What Users Should Know

What happened

enspirit has fixed a vulnerability in elo, an expression language used in no-code tools, that can let supplied text run attacker-selected code. Think of a calculator accepting a math problem and then letting that problem give instructions to the computer itself. The affected releases are earlier than 1.0.1; the fix is available in 1.0.1 and later.

The vendor advisory and NVD identify the issue as CVE-2026-44267. Although it is categorized as cross-site scripting, its effects depend on where elo runs: the browser playground can execute scripts and expose a user's session to compromise, while affected integrations can execute code inside a Node.js host. NVD published the entry on 2026-11-03.

Technical details

Cross-site scripting, or XSS, means attacker-controlled content can execute as script in a browser context. NVD associates this vulnerability with CWE-79, Improper Neutralization of Input During Web Page Generation, commonly called cross-site scripting. It also lists CWE-94, Improper Control of Generation of Code, or code injection, along with CWE-1336 and CWE-693. The code-injection aspect matters because this flaw can affect server-side execution as well as browsers.

The root cause is a gap between parsing an expression and generating JavaScript from it. The parser accepts constructor as a normal identifier, the member-access transformation does not block special properties, and the compiler carries the accepted property access into its generated JavaScript. Together, these behaviors allow a crafted plain-text expression to reach JavaScript's Function constructor through .constructor.constructor and execute attacker-selected code.

The affected entry points include defaultFormats.elo.parse(), the elo command-line tool, and the browser playground. An attacker needs a crafted expression to reach an affected entry point and the resulting generated JavaScript to execute. The playground runs expressions automatically, making browser script execution and session compromise relevant there. This plain-string route is separate from the issue involving programmatically supplied abstract syntax tree objects, which are structured representations of expressions.

NVD assigns a CVSS 3.1 score of 9.8, rated CRITICAL. CVSS is a standardized measure of vulnerability severity; it helps explain why this deserves prompt attention, but it does not establish whether a particular installation is reachable or whether exploitation has occurred. The execution environment determines whether the consequence is browser script execution or arbitrary code execution in a Node.js process.

Weakness types: Cross-site scripting (XSS)

Who is affected

Everyday users

Everyday users are most directly affected when they use the elo browser playground or a service that evaluates elo expressions. In the auto-running playground, a malicious expression can execute browser script and compromise the user's session. The concern is what the expression causes the surrounding application to execute, beyond the result it displays.

If someone else operates the application, its operator needs to confirm that the affected elo component has been updated. A successful page load or a normal-looking expression result does not establish that the underlying version includes the fix.

Developers

Developers embedding elo should pay attention to places where expression text enters the application. This vulnerability works through plain strings, so reviewing only code that constructs expression objects would miss the affected route. An integration that accepts text and passes it through the affected parsing and execution path needs review even if it never accepts structured expression objects from users.

For Node.js integrations, the consequence can be attacker-selected code running in the host process. Review library use as well as automation that evaluates elo expressions. Updating the relevant dependency to 1.0.1 or later addresses the version boundary identified by the vendor; then confirm that the application actually loads the updated dependency.

Server and IT admins

Server and IT administrators should look for elo in hosted applications, continuous integration pipelines, and development or operations automation. Continuous integration means automated jobs that build or test software. An affected expression evaluator in such a job can create a code-execution risk in the environment running it.

Prioritize deployments that receive expression text from outside their trusted operating context. The advisory's server-side impact is arbitrary Node.js code execution, so identifying the process that evaluates expressions is important when assessing exposure and arranging the update.

What to do now

1. Identify applications, developer tools, browser playground deployments, and automation that use elo. Include indirect use through an application dependency.
2. Check the installed or deployed elo version. Releases earlier than 1.0.1 are affected; 1.0.1 and later contain the fix.
3. Update affected installations by following the update steps in the vendor's advisory. Include the dependencies used by deployed applications and automated jobs.
4. Review where externally supplied expression strings reach the parser, command-line tool, or playground. Use that review to prioritize affected deployments and confirm the scope of the update.
5. After updating, confirm the version used by each running application or job and check that ordinary expression processing still works.

If you can't update yet

• Check the vendor advisory for guidance on restricting access to affected expression-processing features while an update is pending.
• Check the vendor advisory for guidance on reducing internet exposure of affected deployments until they can be updated.

How to confirm the fix

• Confirm that the deployed elo version is 1.0.1 or later, including the dependency actually loaded by the application.
• Check each affected execution context separately, including browser playground deployments and Node.js applications or automated jobs.
• Run normal, trusted expressions through the updated integration to confirm expected behavior. Treat functional checks as a supplement to version verification.

NVD scores and CISA KEV status

As of November 6, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 1 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• enspirit advisory: https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5
• NVD: CVE-2026-44267
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on November 6, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.