Elo CVE-2026-44266

Exploitation requires that the attacker-controlled Elo source be compiled to the Ruby target specifically AND that the emitted Ruby then be executed: the /try playground runs it server-side (0-click from a shared PoC URL), bin/eloc -t ruby -x compiles and runs it, and a library integrator must call a Ruby emission step on parsed input and execute the result. The malicious payload is an Elo string literal or a single-quoted subtype-constraint label containing a Ruby interpolation form (#{...}, #@ivar, #@@cvar, #$gvar), with backticks inside #{...} providing shell execution; the subtype sink additionally requires the crafted constraint to fail so its message is evaluated. The key limiting factor is the target language: the identical Elo source compiled to JavaScript, Python, or SQL is benign, so only pipelines that emit and run Ruby from untrusted Elo are exploitable; no authentication or user interaction is needed on the network playground surface (PR:N/UI:N), while the CLI surface is local.

All severity signals point the same direction for the network-facing surfaces. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes unauthenticated, low-complexity, no-interaction remote code execution, and the vuln.today decision label is act_now, so this should be treated as a real priority rather than a high-CVSS-but-low-risk issue. A PoC is not merely theoretical: the GHSA advisory publishes working reproduction code for both the string-literal sink and the subtype-constraint-label sink and states it was verified against Ruby 3.x, which materially raises exploitability. Two signals are missing and must be stated explicitly: no EPSS exploitation-probability score was supplied, and there is no CISA KEV listing in the input, so there is no confirmation of active in-the-wild exploitation - the elevated urgency rests on the act_now decision label, the 9.8 vector, and the verified PoC, not on observed attacks. One nuance tempers raw CVSS: the AV:N/PR:N/UI:N rating fits the /try playground (0-click server-side RCE from a shared URL) and the library-integration path, but the CLI surface (bin/eloc -t ruby -x) is a local vector and the library path requires an integrator to both emit Ruby and execute it, so real-world reach depends on which entry point a given deployment exposes.

An attacker crafts an Elo program containing a string literal or single-quoted subtype-constraint label such as '#{id}' and submits it to the elo-lang.org /try playground with the Ruby target selected, or to any service that compiles attacker-supplied Elo to Ruby and runs it. Because the Ruby emitter does not escape '#', the emitted double-quoted Ruby string interpolates the attacker's '#{...}' expression and its backticks execute a shell command on the host at runtime. A working proof-of-concept for both sinks is published in the GHSA advisory and was verified against Ruby 3.x, and exploitation needs no authentication or user interaction against the network playground surface.