{"metadata": {"vulnerability": "CVE-2026-44265", "count": 11, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 4}}, "data": [{"timestamp": "2026-05-05T16:33:55.845Z", "date_only": false, "value": "2026-05-05T16:33:55.845Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T17:23:04Z", "date_only": false, "value": "2026-10-30T17:23:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "record": "CVE-2026-44265", "field": "creation_timestamp", "uuid": "938568f0-616a-4806-8198-d1b8c8afc27d", "url": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-44265", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T17:48:09Z", "date_only": false, "value": "2026-11-03T17:48:09Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X9RP-7WH3-2RJ5", "record": "GHSA-X9RP-7WH3-2RJ5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T17:48:09Z", "date_only": false, "value": "2026-11-03T17:48:09Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X9RP-7WH3-2RJ5", "record": "GHSA-X9RP-7WH3-2RJ5", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T17:49:42.075Z", "date_only": false, "value": "2026-11-03T17:49:42.075959Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117553769976715223", "record": "CVE-2026-44265", "field": "creation_timestamp", "uuid": "bf56c0d4-4cb0-4b57-a62b-b5f324332bb0", "content": "CVE-2026-44265 Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-44265https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93#enspirit #elo#CVE_2026_44265#bot", "url": "https://infosec.exchange/users/cve/statuses/117553769976715223"}, {"timestamp": "2026-11-03T18:18:02.760Z", "date_only": false, "value": "2026-11-03T18:18:02.760", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-44265", "record": "FKIE_CVE-2026-44265", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T18:18:02.760Z", "date_only": false, "value": "2026-11-03T18:18:02.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-44265", "record": "FKIE_CVE-2026-44265", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T20:30:51Z", "date_only": false, "value": "2026-11-03T20:30:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/a63c53496380f3ea5c5fe8878948beb2", "record": "CVE-2026-44265", "field": "creation_timestamp", "uuid": "ea14c685-36f7-41bd-b0f1-3494fc7ce332", "content": "# CVE-2026-44265: CVE-2026-44265: Code and SQL Injection via Programmatic AST Emission in @enspirit/elo\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-11-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-44265\n\n## Summary\nA code injection and SQL injection vulnerability exists in @enspirit/elo prior to version 1.0.1. When compiling expressions via the programmatic Abstract Syntax Tree (AST) API, the backend emitters for JavaScript, Ruby, Python, and PostgreSQL SQL fail to perform runtime type validation or lexical verification on AST node properties. Applications that construct or deserialize AST nodes from untrusted sources allow attackers to inject arbitrary code or SQL commands directly into the emitted target output.\n\n## TL;DR\nElo compiler backends (@enspirit/elo < 1.0.1) interpolate programmatic AST node properties directly into generated JavaScript, Python, Ruby, and SQL code without runtime validation, enabling Remote Code Execution (RCE) and SQL Injection when untrusted AST structures are compiled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-44265 (GHSA-x9rp-7wh3-2rj5)\n- **Primary CWE**: CWE-94 (Code Injection) / CWE-89 (SQL Injection)\n- **CVSS v3.1 Score**: 7.4 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)\n- **Affected Component**: @enspirit/elo (< 1.0.1) Compiler Backends\n- **Patched Version**: 1.0.1\n- **Impact**: Remote Code Execution (JS, Python, Ruby) & SQL Injection (PostgreSQL)\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- @enspirit/elo (npm package)\n- **@enspirit/elo**: < 1.0.1 (Fixed in: `1.0.1`)\n\n## Mitigation\n\n- Upgrade @enspirit/elo to version 1.0.1 or later to enforce built-in runtime AST validation.\n- Validate all deserialized JSON or external AST structures using a runtime schema validator (e.g., Zod, Ajv) prior to invoking Elo compiler functions.\n- Avoid exposing programmatic AST compilation endpoints directly to client-submitted JSON; prefer parsing raw Elo expression strings through the standard parser.\n- Execute dynamically compiled JavaScript, Python, or Ruby code within isolated sandboxes and run generated SQL queries using least-privilege database roles.\n\n**Remediation Steps:**\n1. Update package.json to require \"@enspirit/elo\": \"^1.0.1\" and run npm install or yarn upgrade.\n2. Audit application code for any direct calls to compileToJavaScript, compileToPython, compileToRuby, or compileToSQL that accept externally constructed AST objects.\n3. Implement try/catch blocks around compilation calls to handle validation errors thrown when malformed AST nodes are encountered.\n\n## References\n\n- [GitHub Security Advisory: GHSA-x9rp-7wh3-2rj5](https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5)\n- [Patch Commit: Validate identifier and numeric-literal IR nodes](https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93)\n- [Release Commit: v1.0.1](https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5)\n- [CVE-2026-44265 Record](https://www.cve.org/CVERecord?id=CVE-2026-44265)\n- [Elo GitHub Repository](https://github.com/enspirit/elo)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-44265) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/a63c53496380f3ea5c5fe8878948beb2"}], "metrics": {"as_of": "2026-11-08T08:02:17.737Z", "anchors": {"origin": {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-30T17:23:04Z", "date_only": false, "value": "2026-10-30T17:23:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "record": "CVE-2026-44265", "field": "creation_timestamp", "uuid": "938568f0-616a-4806-8198-d1b8c8afc27d", "url": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -347039.347, "hours": -96.39981861111112, "days": -4.016659108796296, "min_seconds": -347039.347, "max_seconds": -347039.347, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T17:23:04Z", "date_only": false, "value": "2026-10-30T17:23:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "record": "CVE-2026-44265", "field": "creation_timestamp", "uuid": "938568f0-616a-4806-8198-d1b8c8afc27d", "url": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 396914.390586, "hours": 110.253997385, "days": 4.593916557708333, "min_seconds": 396914.390586, "max_seconds": 396914.390586, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T17:47:03.347Z", "date_only": false, "value": "2026-11-03T17:47:03.347Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-44265", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T08:02:17.737Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 743953.737586, "hours": 206.65381599611112, "days": 8.61057566650463, "min_seconds": 743953.737586, "max_seconds": 743953.737586, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T17:23:04Z", "date_only": false, "value": "2026-10-30T17:23:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "record": "CVE-2026-44265", "field": "creation_timestamp", "uuid": "938568f0-616a-4806-8198-d1b8c8afc27d", "url": "https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-08T08:02:17.737Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}