{"id":"EM-20261103-Q5WN","url":"https://cyber.eventmonitor.net/incident/EM-20261103-Q5WN/","type":"cve","title":"Critical Elo Vulnerability (CVE-2026-44267)","subtitle":"CVE-2026-44267","subject":"CVE-2026-44267","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-03T18:18:03.130Z","firstSignal":"2026-11-03T17:53:42.000Z","lastSignal":"2026-11-03T18:18:03.130Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-03T18:18:03.130Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-03T18:18:03.130Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-03T17:53:42.000Z","what":"First signal: C26 GitHub Advisory Database"},{"at":"2026-11-03T18:18:03.130Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261103-Q5WN created."}],"stages":[{"name":"Disclosed","at":"2026-11-03T18:18:03.130Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-03T18:18:03.130Z","detail":"CVSS 9.8 · EPSS 0.8%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-03T17:53:42.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":4,"title":"GHSA-33r5-xmm8-v6x5 / CVE-2026-44267: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access","text":"npm:@enspirit/elo","url":"https://github.com/advisories/GHSA-33r5-xmm8-v6x5"},{"at":"2026-11-03T18:18:03.130Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-44267 (CVSS 9.8)","text":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise o","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44267"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-03T18:18:03.130","score":9.8,"severity":"CRITICAL","desc":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00833,"pct":0.5776,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}