CVE-2026-44266: Remote Code Execution in @enspirit/elo Ruby Compiler Backend via Unescaped String Interpolation

Vulnerability ID: CVE-2026-44266
CVSS Score: 9.8
Published: 2026-11-03

CVE-2026-44266 (GHSA-7w38-ggh5-v542) is a code injection vulnerability in @enspirit/elo prior to version 1.0.1. The Ruby target compiler fails to escape the hash character (#) when emitting double-quoted Ruby string literals and subtype constraint failure labels. An attacker who supplies crafted Elo expressions to an application compiling and executing Ruby output achieves arbitrary code execution.

TL;DR

The @enspirit/elo Ruby compiler backend fails to escape '#' characters in double-quoted string literals and subtype constraint failure messages, enabling arbitrary Ruby code and shell command execution via #{...} string interpolation.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: Code Injection / Remote Code Execution (CWE-94, CWE-116, CWE-1336)
• Affected Component: @enspirit/elo Ruby Backend Compiler (src/compilers/ruby.ts)
• Attack Vector: Network / Untrusted Elo Expression Compilation to Ruby
• CVSS v3.1 Score: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• Patched Version: @enspirit/elo 1.0.1
• Exploit Status: Functional Proof of Concept (PoC) Published
• CISA KEV Status: Not Listed

Affected Systems

• @enspirit/elo (npm package) < 1.0.1
• Elo CLI (bin/eloc) using the Ruby target (-t ruby)
• Downstream applications compiling untrusted Elo expressions to Ruby
• @enspirit/elo: < 1.0.1 (Fixed in: 1.0.1)

Code Analysis

Commit: 51b8699

Introduce escapeRubyDQ helper in src/compilers/ruby.ts to escape '#' and prevent Ruby string interpolation in string literals and subtype constraint labels.

--- a/src/compilers/ruby.ts
+++ b/src/compilers/ruby.ts
@@ -150,6 +150,22 @@ function emitRubyWithHelpers(ir: IRExpr, options: EmitOptions): EmitResult {
   return { code, requiredHelpers };
 }

+/**
+ * Escape a raw string for embedding inside a Ruby double-quoted string literal.
+ * In particular, `#` must be escaped so that `#{...}`, `#@ivar`, `#@@cvar` and
+ * `#$gvar` cannot trigger Ruby string interpolation — otherwise attacker-controlled
+ * text (string literals, constraint labels, etc.) becomes executable code.
+ */
+function escapeRubyDQ(s: string): string {
+  return s
+    .replace(/\\/g, '\\\\')
+    .replace(/#/g, '\\#')
+    .replace(/"/g, '\\"')
+    .replace(/\n/g, '\\n')
+    .replace(/\t/g, '\\t')
+    .replace(/\r/g, '\\r');
+}
+
 /**
  * Emit Ruby code from IR
  */
@@ -177,11 +193,8 @@ function emitRuby(ir: IRExpr, requiredHelpers?: Set<string>, options?: EmitOptio
     case 'null_literal':
       return 'nil';

-    case 'string_literal': {
-      // Ruby double-quoted strings: escape backslash, double quote, and control chars
-      const escaped = ir.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\t/g, '\\t').replace(/\r/g, '\\r');
-      return `"${escaped}"`;
-    }
+    case 'string_literal':
+      return `"${escapeRubyDQ(ir.value)}"`;

     case 'date_literal':
       return `Date.parse(${JSON.stringify(ir.value)})`;
@@ -408,7 +421,9 @@ function emitTypeExprParser(
         const errorMsg = c.label
           ? (c.label.includes(' ') ? c.label : `constraint '${c.label}' failed`)
           : 'constraint failed';
-        return `return p_fail(p, "${errorMsg}") unless (${conditionCode});`;
+        // Escape for safe embedding in a Ruby double-quoted string: user-controlled
+        // labels (e.g. `Int(i | 'any text': ...)`) must not trigger `#{...}` interpolation.
+        return `return p_fail(p, "${escapeRubyDQ(errorMsg)}") unless (${conditionCode});`;
       }).join(' ');

       return `->(v, p) { _r = (${baseParser}).call(v, p); return _r unless _r[:success]; ${varName} = _r[:value]; ${constraintChecks} _r }`;

Commit: d2a89a8

Release v1.0.1 containing the fix for CVE-2026-44266 / GHSA-7w38-ggh5-v542.

Exploit Details

• GitHub Security Advisory: Official security advisory containing proof-of-concept Elo expressions demonstrating arbitrary command execution via string literals and subtype constraint labels.

Mitigation Strategies

• Upgrade @enspirit/elo to version 1.0.1 or later to ensure '#' characters are properly escaped in generated Ruby string literals.
• Invalidate and regenerate any cached or pre-compiled Ruby code produced by @enspirit/elo versions prior to 1.0.1.
• Avoid using the Ruby compilation backend (-t ruby) for untrusted Elo expressions if immediate patching is not feasible; use the JavaScript, Python, or SQL backends instead.
• Isolate execution of compiled expressions within restricted container sandboxes with dropped capabilities, read-only filesystems, and network egress controls.

Remediation Steps:

1. Update package dependencies by running: npm install @enspirit/elo@^1.0.1
2. Verify the installed version in package-lock.json or node_modules/@enspirit/elo/package.json matches 1.0.1 or higher.
3. Purge any application caches storing previously compiled Ruby code strings generated from user-supplied Elo expressions.
4. Audit CI/CD pipelines and local scripts for invocations of 'eloc -t ruby -x' against untrusted input files.

References

• GitHub Security Advisory GHSA-7w38-ggh5-v542
• Fix Commit: Escape '#' in Ruby Double-Quoted Strings
• Release v1.0.1 Commit
• Official CVE-2026-44266 Record
• @enspirit/elo Source Repository

Read the full report for CVE-2026-44266 on our website for more details including interactive diagrams and full exploit analysis.