CVE-2026-44266

{
  "etk_id": "ETK-2026-3389",
  "cve_id": "CVE-2026-44266",
  "display_id": "CVE-2026-44266",
  "ghsa_id": "GHSA-7w38-ggh5-v542",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Ruby interpolation injection in @enspirit/elo",
  "summary": "Versions of @enspirit/elo before 1.0.1 mishandle untrusted text when producing Ruby output. An attacker who can supply Elo input may cause arbitrary code to run when that Ruby output is evaluated, including through a Ruby-target playground, CLI workflow, or library integration.",
  "mitigation": "Upgrade @enspirit/elo to version 1.0.1. Until upgraded, do not compile or run untrusted Elo input with the Ruby target; disable Ruby-target processing in exposed playgrounds and automation.",
  "vendor": "npm",
  "product": "npm:@enspirit/elo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.0.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.0.1"
      ],
      "package_name": "@enspirit/elo",
      "purl": "pkg:npm/@enspirit/elo"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 12.882492966666666,
  "t0_at": "2026-11-03T17:51:12.013000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-03T18:23:53.790899+00:00",
      "days": 0.02270576271990741,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T17:51:12.013000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-03T17:51:30+00:00",
      "days": 0.00020818287037037037,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T17:51:12.013000+00:00",
      "url": "https://github.com/advisories/GHSA-7w38-ggh5-v542"
    },
    "trigger_signal": {
      "at": "2026-11-03T17:51:12.013000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T17:51:12.013000+00:00",
      "url": "https://github.com/advisories/GHSA-7w38-ggh5-v542"
    }
  }
}