CVE-2026-44265: CVE-2026-44265: Code and SQL Injection via Programmatic AST Emission in @enspirit/elo

When compiling expressions via the programmatic Abstract Syntax Tree (AST) API, the backend emitters for JavaScript, Ruby, Python, and PostgreSQL SQL fail to perform runtime type validation or lexical verification on AST node properties. Applications that construct or deserialize AST nodes from untrusted sources allow attackers to inject arbitrary code or SQL commands directly into the emitted target output. TL;DR Elo compiler backends (@enspirit/elo < 1.0.1) interpolate programmatic AST node properties directly into generated JavaScript, Python, Ruby, and SQL code without runtime validation, enabling Remote Code Execution (RCE) and SQL Injection when untrusted AST structures are compiled. ⚠️ Exploit Status: POC Technical Details CVE ID: CVE-2026-44265 (GHSA-x9rp-7wh3-2rj5) Primary CWE: CWE-94 (Code Injection) / CWE-89 (SQL Injection) CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Component: @enspirit/elo (< 1.0.1) Compiler Backends Patched Version: 1.0.1 Impact: Remote Code Execution (JS, Python, Ruby) & SQL Injection (PostgreSQL) Exploit Status: Proof of Concept (PoC) Available CISA KEV Status: Not Listed Affected Systems @enspirit/elo (npm package) @enspirit/elo: < 1.0.1 (Fixed in: 1.0.1) Code Analysis Commit: fb57dd3 Validate identifier and numeric-literal IR nodes to prevent AST-API injection Commit: d2a89a8 Release v1.0.1 Mitigation Strategies Upgrade @enspirit/elo to version 1.0.1 or later to enforce built-in runtime AST validation.

Validate all deserialized JSON or external AST structures using a runtime schema validator (e.g., Zod, Ajv) prior to invoking Elo compiler functions. Avoid exposing programmatic AST compilation endpoints directly to client-submitted JSON; prefer parsing raw Elo expression strings through the standard parser. Execute dynamically compiled JavaScript, Python, or Ruby code within isolated sandboxes and run generated SQL queries using least-privilege database roles.

Remediation Steps: Update package.json to require "@enspirit/elo": "^1.0.1" and run npm install or yarn upgrade. Audit application code for any direct calls to compileToJavaScript, compileToPython, compileToRuby, or compileToSQL that accept externally constructed AST objects. Implement try/catch blocks around compilation calls to handle validation errors thrown when malformed AST nodes are encountered.

References GitHub Security Advisory: GHSA-x9rp-7wh3-2rj5 Patch Commit: Validate identifier and numeric-literal IR nodes Release Commit: v1.0.1 CVE-2026-44265 Record Elo GitHub Repository Read the full report for CVE-2026-44265 on our website for more details including interactive diagrams and full exploit analysis.