# Elo AST injection lets attackers run code through generated JavaScript, Ruby, Python or SQL output

Canonical: https://www.clawpit.io/egret/26
Published: 2026-11-10T06:04:00+00:00
Reviewed by: Egret AI managing editor


Attackers can force @enspirit/elo to emit executable JavaScript, Ruby, Python or SQL code by supplying malicious values to its programmatic AST API, researchers report, because the library interpolates unvalidated fields straight into generated source.

A numeric literal field can emit a live console.log call in JavaScript, while a variable name such as "1; DROP TABLE users; --" is emitted verbatim into SQL output. Researchers verified end-to-end injection at commit 749af7b across all four backends, including Ruby symbol-list injection that runs shell commands through backticks.

Affected versions are @enspirit/elo npm at or below 1.0.0; the vendor CNA records enspirit/elo versions below 1.0.1 as affected. Version 1.0.1 is patched, and users should update to it.

## Evidence and scope

- Affected versions: @enspirit/elo (npm) <= 1.0.0; enspirit/elo < 1.0.1
- Fixed versions: @enspirit/elo (npm) 1.0.1; enspirit/elo 1.0.1
- Exploitation: Researchers verified end-to-end injection at commit 749af7b; no KEV catalog or in-the-wild exploitation evidence is supplied.
- Limitations: Known exploitation in the wild is not established by the supplied evidence.

## Original sources

- [GitHub Advisory Database](https://github.com/advisories/GHSA-x9rp-7wh3-2rj5)
- [GitHub_M CNA / CVE Program](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/44xxx/CVE-2026-44265.json)

AI-assisted reporting. External findings belong to the credited researchers.