EUVD-2026-116110Published
Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-44266 · CVE overview and exploitation status
cve-program · CVE-2026-44266
- https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542
- https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38
- https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5
euvd · EUVD-2026-116110
- https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542
- https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38
- https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5
nvd · CVE-2026-44266
- https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38
- https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5
- https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542
osv · GHSA-7w38-ggh5-v542
Related changes
Linked by CVE identifier- Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the… · Advisory content revised · 13 Nov 2026
- Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels · Newly collected advisory · 3 Nov 2026
- Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels · Newly collected advisory · 3 Nov 2026