CVE-2026-44266: Critical RCE in Elo Ruby Backend

CVE-2026-44266 is a Remote Code Execution vulnerability in the Ruby backend of Elo, an expression language for no-code tools. The flaw lies in src/compilers/ruby.ts, where attacker-controlled text is embedded in Ruby double-quoted strings without escaping the # character. This enables Ruby interpolation in the literal string emitter and labelled subtype-constraint branch, allowing arbitrary execution of Ruby code and shell commands via backtick.

The vulnerability carries CVSS 9.8 (Critical) and requires no authentication. Multiple entry points: the /try playground when target is Ruby, the bin/eloc -t ruby -x command, and defaultFormats.elo.parse() followed by Ruby emission. The fix is officially available in version 1.0.1. Social signals: 4 public posts report the flaw within the last 24 hours, confirming awareness of its criticality.

IT teams and system administrators must act immediately. Verify which version of Elo is running, especially where the /try playground is exposed or bin/eloc is executing. Update to version 1.0.1 or later within hours. If immediate patching is not feasible, disable access to the /try playground with Ruby backend and evaluate isolating bin/eloc from networked systems. Monitor access and execution logs to detect any exploitation attempts.

The vulnerability affects exclusively Elo's Ruby compilation path. The JavaScript, Python, and SQL backends are not affected by this string handling and interpolation weakness. This indicates that proper escaping has been implemented in those other compilers but not in the Ruby one, highlighting the risk of code generation inconsistency across multiple compilation targets.