CVE-2026-44267: RCE in Elo no-code engine

CVE-2026-44267 identifies a remote code execution (RCE) vulnerability in the Elo expression language, used in no-code tools. The flaw affects versions prior to 1.0.1 and permits attackers to execute attacker-selected JavaScript code in browsers via elo-lang.org/try, in the Elo library, or in Node.js environments such as CI/CD and DevOps hosts. The attack vector is an Elo string supplied to defaultFormats.elo.parse() or bin/elo that exploits meta-properties .constructor.constructor to reach the JavaScript Function object.

The severity is rated CRITICAL with a CVSS score of 9.8. The flaw exists because the member_access handler in src/transform.ts does not reject meta-properties, the JavaScript compiler in src/compilers/javascript.ts emits the surviving property directly into generated code, and the parser in src/parser.ts accepts 'constructor' as an ordinary identifier. Activity was detected in a public GitHub repository on 2026-11-04, consistent with the NVD publication on 2026-11-03.

To defend: update Elo to version 1.0.1 or later immediately on all systems, including web playgrounds, Node.js libraries, CI/CD pipelines, and DevOps hosts. Verify the running version with 'elo --version' or by checking package.json. If you use elo-lang.org/try, it will be updated automatically. Monitor logs for suspicious Node.js execution or anomalous behavior in CI/CD.