---
title: "CVE-2026-44267: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access"
url: https://erroneo.us/security/cve/CVE-2026-44267/
description: "CVE-2026-44267 (@enspirit/elo (npm)): Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-11-03
date_modified: 2026-11-03
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-44267"
kev: false
cvss: 9.8
epss: 0.00833
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-44267: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.8% , percentile 58: FIRST’s model estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 58% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes @enspirit/elo (npm) <= 1.0.0, fixed in 1.0.1 . Check your lockfile, including transitive dependencies.

## What it is

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.

## Affected packages

- npm `@enspirit/elo` <= 1.0.0 → fixed: 1.0.1

## Affected products (CVE record)

- enspirit elo: < 1.0.1

## Severity

- GitHub_M CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- FIRST EPSS (model of 2026-11-04): 0.83% probability of exploitation activity in the next 30 days; percentile 58.

## Sources

- [GitHub Advisory GHSA-33r5-xmm8-v6x5](https://github.com/advisories/GHSA-33r5-xmm8-v6x5)
- [CVE.org record CVE-2026-44267](https://www.cve.org/CVERecord?id=CVE-2026-44267)
- [NVD entry CVE-2026-44267](https://nvd.nist.gov/vuln/detail/CVE-2026-44267)
- [github.com](https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5)
- [github.com](https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842)
- [github.com](https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5)

---
Source page: https://erroneo.us/security/cve/CVE-2026-44267/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt