Elo expression language runs code and SQL injection from outside input

Summary

Elo is an expression language used in no-code tools. Unchecked values reach the AST API, the Ruby backend and the plain-string JavaScript path, so attackers can run code or inject SQL.

Affected when

• untrusted values passed unchecked into the AST API
• Ruby backend compilation
• plain strings compiled to JavaScript

What to do

Update to Elo 1.0.1 or later.

Products and platforms

• elo

CVE IDs

• CVE-2026-44265 (opens in a new tab)
• CVE-2026-44266 (opens in a new tab)
• CVE-2026-44267 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
• KISA notice: KISA 보호나라: enspirit 제품 보안 업데이트 권고 (opens in a new tab)

Times

First published 2026-11-03 17:47 UTC

First seen 2026-11-09 14:50 UTC