critical vulnerability

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

Fix availableCritical · CVSS 9.8

Published Nov 3, 2026 · updated Nov 3, 2026

What to do

Upgrade to a fixed version: @enspirit/elo 1.0.1.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@enspirit/elo757 downloads/week

Vulnerable versions: <= 1.0.0
Fixed in: 1.0.1

Check your project: npm ls @enspirit/elo --all

Is @enspirit/elo@1.0.1 safe to install? See the upgrade verdict →

What changed

Nov 3, 2026
Published in the GitHub Advisory Database as critical.

Sources

GitHub Advisory GHSA-33r5-xmm8-v6x5
NVD CVE-2026-44267

CWE-79 Improper Neutralization of Input During Web Page Generation · CWE-94 Improper Control of Generation of Code · CWE-693 Protection Mechanism Failure · CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

← All critical vulnerabilities