CVE-2026-44266

Name of the Vulnerable Software and Affected Versions Elo versions prior to 1.0.1

Description The Ruby backend in src/compilers/ruby.ts fails to escape the # character when embedding text in Ruby double-quoted strings. This allows Ruby interpolation to occur in the string-literal emitter or the labelled subtype-constraint branch, leading to the execution of arbitrary Ruby code and shell commands via backticks. The affected entry points are the /try playground with the Ruby target, bin/eloc -t ruby -x, and the defaultFormats.elo.parse() function followed by Ruby emission.

Recommendations Update to version 1.0.1.