Arbitrary Code Execution and SQL Injection Vulnerability in Elo Language

CVE-2026-44265

What is CVE-2026-44265?

The Elo expression language, utilized in no-code tools, has a vulnerability due to its programmatic AST API allowing unvalidated inputs from varying sources like JSON and plugin outputs. This oversight enables crafted inputs to be evaluated as executable code, creating paths for arbitrary code execution in JavaScript, Ruby, and Python environments, along with SQL injection risks. The vulnerability affects specific fields, including int_literal / float_literal values, variable names, and others. Users should upgrade to version 1.0.1 to mitigate these risks effectively.

References