critical vulnerability

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Fix availableCritical · CVSS 9.8

Published Nov 3, 2026 · updated Nov 3, 2026

What to do

Upgrade to a fixed version: @enspirit/elo 1.0.1.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@enspirit/elo757 downloads/week

Vulnerable versions: <= 1.0.0
Fixed in: 1.0.1

Check your project: npm ls @enspirit/elo --all

Is @enspirit/elo@1.0.1 safe to install? See the upgrade verdict →

What changed

Nov 3, 2026
Published in the GitHub Advisory Database as critical.

Sources

GitHub Advisory GHSA-7w38-ggh5-v542
NVD CVE-2026-44266

CWE-94 Improper Control of Generation of Code · CWE-116 Improper Encoding or Escaping of Output · CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

← All critical vulnerabilities