CVE-2026-44267

Name of the Vulnerable Software and Affected Versions Elo versions prior to 1.0.1

Description Plain Elo strings provided to the defaultFormats.elo.parse() function, bin/elo, or the elo-lang.org/try endpoint can lead to the execution of attacker-selected code in the host runtime. This occurs because the member access handler in src/transform.ts fails to reject meta-properties, the src/compilers/javascript.ts file emits the property directly, and src/parser.ts accepts constructor as a standard identifier. An attacker can use .constructor.constructor to access the JavaScript Function object, enabling browser script execution and session compromise on the playground, or arbitrary Node.js code execution on library, CI, or DevOps hosts.

Recommendations Update Elo to version 1.0.1.