Elo
Monthly
Elo 1.0.0 and earlier - a purely functional expression language used as a rule-engine, config and form-builder DSL - lets an attacker who controls a plain Elo source string reach the JavaScript `Function` constructor and run arbitrary code in the host runtime. The vulnerable string can arrive through `defaultFormats.elo.parse()`, the `bin/elo` CLI (including the `-f elo` flag documented to pass user files as data), or the auto-running `elo-lang.org/try?code=...&run=1` playground, where a shared link yields 0-click script execution and session compromise in the visitor's browser. The vendor advisory ships proof-of-concept payloads for all three entry points, and the issue is fixed in 1.0.1; no CISA KEV entry was provided in the source data, and the priority decision is act_now.
Ruby code execution in Elo (npm @enspirit/elo) through 1.0.0 lets an attacker who controls Elo source gain arbitrary Ruby and shell command execution whenever that source is compiled to the Ruby target and the emitted code is run. The Ruby backend in src/compilers/ruby.ts inserts string literals and labelled subtype-constraint messages into Ruby double-quoted strings without escaping '#', so payloads such as 'RES=#{`id`}' survive compilation intact and execute when the generated Ruby is evaluated; the server-side /try playground with the Ruby target, bin/eloc -t ruby -x, and library integrations that call a Ruby emission step on parsed input are all exposed. The network-facing playground surface needs no authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 9.8), and the advisory ships working proof-of-concept Elo snippets; the same Elo source compiled to JavaScript, Python, or SQL is harmless, so only pipelines that emit and execute Ruby from untrusted Elo are exploitable, and no CISA KEV listing or independent confirmation of exploitation in the wild is present in the available data.
Code injection in Elo's programmatic AST API (npm @enspirit/elo) through version 1.0.0 allows an integrator who populates AST node fields from JSON-deserialized input, plugin output, or other untyped sources to inject arbitrary expressions and identifiers into the JavaScript, Ruby, Python, or SQL emitted by the compiler, yielding arbitrary code execution on the JS/Ruby/Python backends and SQL injection on the SQL backend. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.4) reflects maximum impact but a gated exploitation path: the flaw is reachable only when an application builds the AST itself rather than parsing plain Elo strings, and the advisory ships end-to-end proof-of-concept payloads that were verified against all four backends, though there is no CISA KEV entry and no confirmed active exploitation. It is a non-default integration choice, not a flaw in the parser, and is distinct from the earlier plain-string constructor-chain sandbox escape. Fixed in 1.0.1.
Elo 1.0.0 and earlier - a purely functional expression language used as a rule-engine, config and form-builder DSL - lets an attacker who controls a plain Elo source string reach the JavaScript `Function` constructor and run arbitrary code in the host runtime. The vulnerable string can arrive through `defaultFormats.elo.parse()`, the `bin/elo` CLI (including the `-f elo` flag documented to pass user files as data), or the auto-running `elo-lang.org/try?code=...&run=1` playground, where a shared link yields 0-click script execution and session compromise in the visitor's browser. The vendor advisory ships proof-of-concept payloads for all three entry points, and the issue is fixed in 1.0.1; no CISA KEV entry was provided in the source data, and the priority decision is act_now.
Ruby code execution in Elo (npm @enspirit/elo) through 1.0.0 lets an attacker who controls Elo source gain arbitrary Ruby and shell command execution whenever that source is compiled to the Ruby target and the emitted code is run. The Ruby backend in src/compilers/ruby.ts inserts string literals and labelled subtype-constraint messages into Ruby double-quoted strings without escaping '#', so payloads such as 'RES=#{`id`}' survive compilation intact and execute when the generated Ruby is evaluated; the server-side /try playground with the Ruby target, bin/eloc -t ruby -x, and library integrations that call a Ruby emission step on parsed input are all exposed. The network-facing playground surface needs no authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 9.8), and the advisory ships working proof-of-concept Elo snippets; the same Elo source compiled to JavaScript, Python, or SQL is harmless, so only pipelines that emit and execute Ruby from untrusted Elo are exploitable, and no CISA KEV listing or independent confirmation of exploitation in the wild is present in the available data.
Code injection in Elo's programmatic AST API (npm @enspirit/elo) through version 1.0.0 allows an integrator who populates AST node fields from JSON-deserialized input, plugin output, or other untyped sources to inject arbitrary expressions and identifiers into the JavaScript, Ruby, Python, or SQL emitted by the compiler, yielding arbitrary code execution on the JS/Ruby/Python backends and SQL injection on the SQL backend. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.4) reflects maximum impact but a gated exploitation path: the flaw is reachable only when an application builds the AST itself rather than parsing plain Elo strings, and the advisory ships end-to-end proof-of-concept payloads that were verified against all four backends, though there is no CISA KEV entry and no confirmed active exploitation. It is a non-default integration choice, not a flaw in the parser, and is distinct from the earlier plain-string constructor-chain sandbox escape. Fixed in 1.0.1.