KEVWire

Security intelligence, with context.

Response snapshot Nov 3, 2026, 19:21 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-44265

Elo backends have code injection via unvalidated emission of programmatic AST fields

Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass.

Published Updated

At a glance

Exploited
Not known
Severity
7.4 High (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
2 independent sources

What to do

GitHub lists first patched versions: @enspirit/elo: 1.0.1. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-x9rp-7wh3-2rj5 (opens a new tab)

What happened

Summary

Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input, plugin output, or any other untyped source therefore exposes a code-injection primitive that flows through to the emitted JavaScript, Ruby, Python, or SQL.

The same pattern was previously addressed in 0.9.7 (2026-01-27), which patched the date/datetime/duration literal emitters via JSON.stringify() after a report by naoyashiga. This advisory generalises that fix to the remaining AST surface — at least 23 emission sites across six node-field categories and four backends.

Vulnerable sinks

Continue reading

Each row is a category of sinks that share the same shape: TypeScript signature erased at runtime → AST-API consumer passes a crafted value → emit interpolates the value verbatim.

| # | AST field | Affected backends | Resulting injection | |---|---|---|---| | 1 | int_literal / float_literal .value | JS, Ruby, Python, SQL | Arbitrary expression in the emitted numeric position (RCE on JS/Ruby/Python; SQL expression injection) | | 2 | variable.

name | JS, Ruby, Python, SQL | Identifier-position injection; on SQL, raw SQL injection because undefined identifiers are intentionally emitted as column references | | 3 | member_access.

property | JS, Ruby, Python, SQL | Property access escaped into expression (RCE) | | 4 | object_literal key | JS, Ruby, SQL | Computed-key / extra-property injection (RCE on JS/Ruby; SQL injection) | | 5 | datapath segment | JS, Ruby, Python, SQL | Ruby symbol-list injection allows backtick shell exec; SQL string-segment unquoted in single-quote context allows SQL injection | | 6 | lambda.params[].

name | JS, Ruby, Python | Parameter-list structural injection (RCE) | | 7 | SQL let binding name | SQL | Identifier injection in … AS clause |

Proof of Concept

End-to-end execution was verified at commit 749af7b for representative cases per backend. Examples:

Numeric literal injection (all four backends). Feeding the following AST through compileToJavaScript emits a live console.log on call:

{ type: 'literal', value: "(console.log('PWN_INT_JS'),1)" }
// emits: (function(_) { return (console.log('PWN_INT_JS'),1); })(null);

The same AST against Ruby with "(system('touch /tmp/pwn_int_ruby'); 1)" creates the file; Python with "(print('PWN_INT_PY') or 1)" prints the sentinel; SQL emits the raw string into the numeric position.

SQL variable.name injection:

{ type: 'variable', name: "1; DROP TABLE users; --" }
// emits: 1; DROP TABLE users; --

Ruby datapath segment shell-exec:

{ type: 'datapath', segments: ["a, system(`touch /tmp/pwn_dp_ruby`)"] }
// emits: [:a, system(`touch /tmp/pwn_dp_ruby`)]

All ten end-to-end cases are automated in the ast-exec.js / ast-exec2.js scripts attached to the original report; each console.log and sentinel file was observed.

Independence from GHSA #2

This finding is independent of GHSA #2 (the .constructor.constructor sandbox escape). That report covers payloads delivered as plain Elo *strings* through the parser; the present advisory covers payloads delivered as AST *objects* through the programmatic API.

The two threat models do not overlap: GHSA #2's identifier regex ^[a-zA-Z_][a-zA-Z0-9_]*$ accepts constructor (and is the right behaviour for a parser), while the present advisory adds runtime validation at every backend emit site so that AST-API consumers cannot inject arbitrary text into emitted source.

Affected package ranges reported by GitHub: @enspirit/elo: <= 1.0.0

Scores and how they were measured

CVSS base severity

7.4

Version 3.1As of

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow JavaScript packages (npm): RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-x9rp-7wh3-2rj5 (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-x9rp-7wh3-2rj5, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

  3. Primary source

    NVD CVE-2026-44265 (opens a new tab)

    NVD record: description, CVSS (the CNA score is preferred), affected products, and publication date. Not evidence of exploitation.

    Published Checked

  4. Primary source

    NVD CVE API 2.0 (opens a new tab)

    The NVD API page that supplied this CVE record.

    Published Date not suppliedChecked

  5. Primary source

    NVD CVE API 2.0 (opens a new tab)

    The NVD API page that supplied this CVE record.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, November 3). Elo backends have code injection via unvalidated emission of programmatic AST fields (CVE-2026-44265). https://kevwire.com/record/CVE-2026-44265

MLA

"Elo backends have code injection via unvalidated emission of programmatic AST fields (CVE-2026-44265)." KEVWire, 3 Nov. 2026, kevwire.com/record/CVE-2026-44265.

Chicago

KEVWire. "Elo backends have code injection via unvalidated emission of programmatic AST fields (CVE-2026-44265)." Last modified November 3, 2026. https://kevwire.com/record/CVE-2026-44265.

Evidence summary (plain text)

Elo backends have code injection via unvalidated emission of programmatic AST fields (Nov 3, 2026).
Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input, plugin output, or any other untyped source therefore exposes a code-injection primitive that flows through to the emitted JavaScript, Ruby, Python, or SQL.
CVSS 7.4 (version 3.1; evidence as of Nov 3, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44265).
Sources:
GitHub-reviewed advisory GHSA-x9rp-7wh3-2rj5: https://github.com/advisories/GHSA-x9rp-7wh3-2rj5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-44265: https://nvd.nist.gov/vuln/detail/CVE-2026-44265
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-11-03T17:35:57.416Z&lastModEndDate=2026-11-03T19:05:57.748Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-11-03T17:01:00.112Z&lastModEndDate=2026-11-03T18:35:55.788Z&resultsPerPage=500&startIndex=0
Record ID: CVE-2026-44265.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Nov 3, 2026, 19:05 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail