CVE-2026-44265

Name of the Vulnerable Software and Affected Versions Elo versions prior to 1.0.1

Description Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. This allows crafted values to become executable expressions or identifiers, leading to arbitrary code execution in JavaScript, Ruby, and Python targets, and SQL injection in the SQL target. The issue affects several AST fields, including int literal / float literal .value, variable.name, member access.property, object literal keys, datapath segments, lambda.params[].name, and the SQL let binding name.

Recommendations Update Elo to version 1.0.1.