Elo EUVD-2026-116111

No special configuration is required: default behavior of Elo <= 1.0.0 is affected wherever an attacker controls the plain Elo source string reaching a JavaScript-emission sink - defaultFormats.elo.parse(), the bin/elo CLI (including the -f elo flag that is documented to pass user files as data, and -e/-d @file), or the elo-lang.org/try playground with ?run=1 auto-execution. The only genuine prerequisites/limits are: the attacker must be able to supply the Elo string to one of these paths, and the deployment must run a vulnerable version (<= 1.0.0, fixed in 1.0.1). No authentication, no privileges, and no victim interaction are needed for the library/CLI paths; the playground path requires only that the victim open a crafted link (execution is then automatic). The vendor's patch (meta-property denylist) is the stated fix.

All severity signals point the same direction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a trivially triggered, unauthenticated path to full arbitrary code execution, and my independent assessment agrees with every metric. The vuln.today decision label is act_now, which is the operative urgency signal here. A working proof-of-concept is published in the GHSA advisory - including a full child_process payload and a screen recording of end-to-end execution against the live production playground - so exploitation is proven, not theoretical. Two expected signals are absent from the input and must not be assumed present: there is no EPSS score supplied, and there is no CISA KEV entry, so this is NOT confirmed actively exploited in the wild - treat it as a demonstrated, weaponizable flaw rather than an observed campaign. The main thing that tempers real-world risk is reach, not difficulty: Elo is a niche no-code expression DSL, so the blast radius is limited by how few hosts run it, not by any exploitation hurdle. Net: a genuine high priority for anyone who embeds Elo (rule/config/form DSL, CI tooling, or the hosted playground), driven by act_now plus a demonstrated PoC plus a vendor-confirmed root cause and fix, with the caveat that widespread opportunistic exploitation is unproven absent EPSS/KEV data.

An attacker crafts a plain Elo string using the ({}).constructor.constructor('...')() chain and gets it into any JavaScript-emission path - e.g. sharing an elo-lang.org/try/?code=...&run=1 link that auto-executes in the victim's browser after ~100ms (0-click XSS/session compromise), or feeding an attacker-controlled .elo file to bin/elo or a downstream service's defaultFormats.elo.parse() on a Node.js/CI host. The compiled output invokes a live Function(), running attacker-selected code in the host runtime (the advisory's PoC executes child_process and returns id output). A fully working PoC for all three entry points is published in the GHSA advisory.