All 3 CVE vulnerabilities found in elo, with AI-generated Chinese analysis, references, and POCs.
Vendor: enspirit
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-44267 | Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter CWE-79 | 9.8 | Critical | 2026-11-03 |
| CVE-2026-44266 | Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels CWE-94 | 9.8 | Critical | 2026-11-03 |
| CVE-2026-44265 | Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields CWE-20 | 7.4 | High | 2026-11-03 |
All 3 known CVE vulnerabilities affecting elo with full Chinese analysis, references, and POCs where available.