CVE-2026-44267: CVE-2026-44267: Sandbox Escape and Arbitrary Code Execution in Elo Expression Language

#security #cve #cybersecurity

CVE-2026-44267: Sandbox Escape and Arbitrary Code Execution in Elo Expression Language

Vulnerability ID: CVE-2026-44267
CVSS Score: 9.8
Published: 2026-11-03

CVE-2026-44267 is a sandbox escape and code injection vulnerability in @enspirit/elo prior to version 1.0.1. Due to unrestricted member access transformation in the compiler pipeline, plain Elo expression strings can traverse JavaScript object prototypes via .constructor.constructor to access the host runtime Function constructor. This allows attackers supplying untrusted Elo expressions to execute arbitrary JavaScript in Node.js server environments or client browser contexts.

TL;DR

Elo versions prior to 1.0.1 fail to block JavaScript prototype reflection properties such as .constructor during AST-to-IR transformation. Attackers can supply crafted expression strings like ({}).constructor.constructor('return process')() to escape the functional sandbox and achieve arbitrary code execution in Node.js or Cross-Site Scripting (XSS) in browser environments.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-44267 (GHSA-33r5-xmm8-v6x5)
CWE Classification: CWE-94 (Code Injection) / CWE-693 (Protection Mechanism Failure)
CVSS v3.1 Score: 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Attack Vector: Network (Untrusted Elo expression strings)
Affected Component: @enspirit/elo (< 1.0.1) — src/transform.ts & src/compilers/javascript.ts
Impact: Sandbox Escape to Arbitrary Node.js Code Execution or Browser XSS
Exploit Status: Proof-of-Concept (PoC) publicly documented
CISA KEV Status: Not Listed

Affected Systems

@enspirit/elo
elo
Elo CLI (bin/elo)
Elo Browser Playground (elo-lang.org/try)
@enspirit/elo: < 1.0.1 (Fixed in: 1.0.1)

Code Analysis

Commit: 2136da1

Block forbidden member access properties (constructor, proto, prototype, etc.) in src/transform.ts

diff --git a/src/transform.ts b/src/transform.ts
index 59c86621..4b177242 100644
--- a/src/transform.ts
+++ b/src/transform.ts
@@ -46,6 +46,16 @@ import { EloType, Types, TypeKind } from './types';
 import { eloTypeDefs } from './typedefs';
 import { parseExtractTemplate } from './extract';

+const FORBIDDEN_MEMBERS: ReadonlySet<string> = new Set([
+  'constructor',
+  '__proto__',
+  'prototype',
+  '__defineGetter__',
+  '__defineSetter__',
+  '__lookupGetter__',
+  '__lookupSetter__',
+]);
+
 /**
  * Type environment: maps variable names to their inferred types
  */
@@ -145,6 +155,13 @@ function transformWithDepth(
       const objectIR = recurse(expr.object);
       const objectType = inferType(objectIR);

+      if (FORBIDDEN_MEMBERS.has(expr.property)) {
+        throw new Error(
+          `Member access '.${expr.property}' is forbidden: this name would ` +
+          `expose the host runtime and is not a valid Elo property.`
+        );
+      }
+
       // Only allow member access on data types (any, object, array)
       // This prevents exposing runtime internals like Luxon DateTime/Duration methods
       const allowedTypes: TypeKind[] = ['any', 'object', 'array'];

Commit: d2a89a8

Release version 1.0.1 containing fix for CVE-2026-44267

Exploit Details

GitHub Security Advisory & Upstream Regression Tests: Proof-of-concept payloads documented in the official advisory and test/unit/security.unit.test.ts demonstrating sandbox escape via .constructor.constructor.

Mitigation Strategies

Upgrade @enspirit/elo to version 1.0.1 or later to enforce compile-time rejection of forbidden prototype properties.
Implement pre-parsing regular expression filters or Web Application Firewall (WAF) rules to block expressions referencing .constructor, .proto, or .prototype.
Isolate server-side expression evaluation processes using restricted container environments, non-root execution users, and strict network egress controls.

Remediation Steps:

Audit application dependencies (package.json and lockfiles) for @enspirit/elo or elo versions prior to 1.0.1.
Run 'npm install @enspirit/elo@^1.0.1' or 'yarn upgrade @enspirit/elo@^1.0.1' to apply the patched version.
Verify that unit and integration tests pass and confirm that member access to '.constructor' throws a compile-time error.
Redeploy affected backend services, CLI runners, and browser bundle assets.

References

Read the full report for CVE-2026-44267 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community