CVE-2026-44265: Code and SQL Injection via Programmatic AST Emission in @enspirit/elo

Vulnerability ID: CVE-2026-44265
CVSS Score: 7.4
Published: 2026-11-03

A code injection and SQL injection vulnerability exists in @enspirit/elo prior to version 1.0.1. When compiling expressions via the programmatic Abstract Syntax Tree (AST) API, the backend emitters for JavaScript, Ruby, Python, and PostgreSQL SQL fail to perform runtime type validation or lexical verification on AST node properties. Applications that construct or deserialize AST nodes from untrusted sources allow attackers to inject arbitrary code or SQL commands directly into the emitted target output.

TL;DR

Elo compiler backends (@enspirit/elo < 1.0.1) interpolate programmatic AST node properties directly into generated JavaScript, Python, Ruby, and SQL code without runtime validation, enabling Remote Code Execution (RCE) and SQL Injection when untrusted AST structures are compiled.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-44265 (GHSA-x9rp-7wh3-2rj5)
• Primary CWE: CWE-94 (Code Injection) / CWE-89 (SQL Injection)
• CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
• Affected Component: @enspirit/elo (< 1.0.1) Compiler Backends
• Patched Version: 1.0.1
• Impact: Remote Code Execution (JS, Python, Ruby) & SQL Injection (PostgreSQL)
• Exploit Status: Proof of Concept (PoC) Available
• CISA KEV Status: Not Listed

Affected Systems

• @enspirit/elo (npm package)
• @enspirit/elo: < 1.0.1 (Fixed in: 1.0.1)

Code Analysis

Commit: fb57dd3

Validate identifier and numeric-literal IR nodes to prevent AST-API injection

Commit: d2a89a8

Release v1.0.1

Mitigation Strategies

• Upgrade @enspirit/elo to version 1.0.1 or later to enforce built-in runtime AST validation.
• Validate all deserialized JSON or external AST structures using a runtime schema validator (e.g., Zod, Ajv) prior to invoking Elo compiler functions.
• Avoid exposing programmatic AST compilation endpoints directly to client-submitted JSON; prefer parsing raw Elo expression strings through the standard parser.
• Execute dynamically compiled JavaScript, Python, or Ruby code within isolated sandboxes and run generated SQL queries using least-privilege database roles.

Remediation Steps:

1. Update package.json to require "@enspirit/elo": "^1.0.1" and run npm install or yarn upgrade.
2. Audit application code for any direct calls to compileToJavaScript, compileToPython, compileToRuby, or compileToSQL that accept externally constructed AST objects.
3. Implement try/catch blocks around compilation calls to handle validation errors thrown when malformed AST nodes are encountered.

References

• GitHub Security Advisory: GHSA-x9rp-7wh3-2rj5
• Patch Commit: Validate identifier and numeric-literal IR nodes
• Release Commit: v1.0.1
• CVE-2026-44265 Record
• Elo GitHub Repository

Read the full report for CVE-2026-44265 on our website for more details including interactive diagrams and full exploit analysis.