CVE-2026-44265

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax...

Elo backends have code injection via unvalidated emission of programmatic AST fields

Summary Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input,...

Internet Bug Bounty: Multiple use after frees in obj2ast_* methods

Multiple UAFs in Python AST API. link to bugtracker...