CVE-2026-44267 - Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
CVE ID :CVE-2026-44267 Published : Nov. 3, 2026, 6:18 p.m. | 46 minutes ago Description :Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to...