JavaScript Execution Vulnerability in Elo Language by Enspirit

CVE-2026-44267

What is CVE-2026-44267?

Elo, a functional expression language designed for no-code tools, contains a significant vulnerability that allows attackers to execute arbitrary JavaScript code. Prior to version 1.0.1, the functions within Elo could improperly handle plain strings, leading to unauthorized access to the JavaScript environment via meta-properties and constructors. This flaw not only compromises the security of applications running the Elo language, but also poses a risk of session hijacking and code execution in various host environments, including web browsers and Node.js. The issue has been resolved in the 1.0.1 update, which addresses the vulnerabilities associated with the parsing process of these plain Elo strings.

References