Summary
Elo backends have code injection via unvalidated emission of programmatic AST fields
Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input, plugin output, or any other untyped source therefore exposes a code-injection primitive that flows through to the emitted JavaScript, Ruby, Python, or SQL.
The same pattern was previously addressed in 0.9.7 (2026-01-27), which patched the date/datetime/duration literal emitters via JSON.stringify() after a report by naoyashiga. This advisory generalises that fix to the remaining AST surface, at least 23 emission sites across six node-field categories and four backends.
Vulnerable sinks
Each row is a category of sinks that share the same shape: TypeScript signature erased at runtime → AST-API consumer passes a crafted value → emit interpolates the value verbatim.
| # | AST field | Affected backends | Resulting injection |
|---|---|---|---|
| 1 | int_literal / float_literal .value |
JS, Ruby, Python, SQL | Arbitrary expression in the emitted numeric position (RCE on JS/Ruby/Python; SQL expression injection) |
| 2 | variable.name |
JS, Ruby, Python, SQL | Identifier-position injection; on SQL, raw SQL injection because undefined identifiers are intentionally emitted as column references |
| 3 | member_access.property |
JS, Ruby, Python, SQL | Property access escaped into expression (RCE) |
| 4 | object_literal key |
JS, Ruby, SQL | Computed-key / extra-property injection (RCE on JS/Ruby; SQL injection) |
| 5 | datapath segment |
JS, Ruby, Python, SQL | Ruby symbol-list injection allows backtick shell exec; SQL string-segment unquoted in single-quote context allows SQL injection |
| 6 | lambda.params[].name |
JS, Ruby, Python | Parameter-list structural injection (RCE) |
| 7 | SQL let binding name |
SQL | Identifier injection in … AS <name> clause |
Proof of Concept
End-to-end execution was verified at commit 749af7b for representative cases per backend. Examples:
Numeric literal injection (all four backends). Feeding the following AST through compileToJavaScript emits a live console.log on call:
{ type: 'literal', value: "(console.log('PWN_INT_JS'),1)" }
// emits: (function(_) { return (console.log('PWN_INT_JS'),1); })(null);
The same AST against Ruby with "(system('touch /tmp/pwn_int_ruby'); 1)" creates the file; Python with "(print('PWN_INT_PY') or 1)" prints the sentinel; SQL emits the raw string into the numeric position.
SQL variable.name injection:
{ type: 'variable', name: "1; DROP TABLE users; --" }
// emits: 1; DROP TABLE users; --
Ruby datapath segment shell-exec:
{ type: 'datapath', segments: ["a, system(`touch /tmp/pwn_dp_ruby`)"] }
// emits: [:a, system(`touch /tmp/pwn_dp_ruby`)]
All ten end-to-end cases are automated in the ast-exec.js / ast-exec2.js scripts attached to the original report; each console.log and sentinel file was observed.
Independence from GHSA #2
This finding is independent of GHSA #2 (the .constructor.constructor sandbox escape). That report covers payloads delivered as plain Elo strings through the parser; the present advisory covers payloads delivered as AST objects through the programmatic API. The two threat models do not overlap: GHSA #2's identifier regex ^[a-zA-Z_][a-zA-Z0-9_]*$ accepts constructor (and is the right behaviour for a parser), while the present advisory adds runtime validation at every backend emit site so that AST-API consumers cannot inject arbitrary text into emitted source.
Impact
The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.
CVE-2026-44265 has a CVSS score of 7.4 (High). The vector is requires local access, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-44265? CVE-2026-44265 is a high-severity improper input validation vulnerability in @enspirit/elo (npm), affecting versions <= 1.0.0. It is fixed in 1.0.1. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
- How severe is CVE-2026-44265? CVE-2026-44265 has a CVSS score of 7.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @enspirit/elo are affected by CVE-2026-44265? @enspirit/elo (npm) versions <= 1.0.0 is affected.
- Is there a fix for CVE-2026-44265? Yes. CVE-2026-44265 is fixed in 1.0.1. Upgrade to this version or later.
- Is CVE-2026-44265 exploitable, and should I be worried? Whether CVE-2026-44265 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-44265 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-44265? Upgrade
@enspirit/eloto 1.0.1 or later.