Elo backends have code injection via unvalidated emission of programmatic AST fields
CVE-2026-44265
Summary Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input, plugin output, or any other untyped source therefore exposes a code-injection primitive that flows through to the emitted JavaScript, Ruby, Python, or SQL. The same pattern was previously addressed in 0.9.7 (2026-01-27), which patched the date/datetime/duration literal emitters via JSON.stringify() after a report by naoyashiga. This advisory generalises that fix to the remaining AST surface — at least 23 emission sites across six node-field categories and four backends. Vulnerable sinks Each row is a category of sinks that share the same shape: TypeScript signature erased at runtime → AST-API consumer passes a crafted value → emit interpolates the value verbatim. | # | AST field | Affected backends | Resulting injection | |---|---|---|---| | 1 | intliteral / floatliteral .value | JS, Ruby, Python, SQL | Arbitrary expression in the emitted numeric position (RCE on JS/Ruby/Python; SQL…
Assessment
- CVSS
- 7.4 (v3.1)
- Severity
- High
- EPSS
- 0% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 3 November 2026
- Last updated
- 3 November 2026
- Affected
- enspirit · elo · @enspirit/elo
- Weakness
- CWE-20, CWE-749, CWE-89, CWE-94
- Assigner
- GitHub_M
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-44265