CVE-2026-44266

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — defaultFormats.elo.parse, the bin/elo CLI, or the live browser playground at elo-lang.org/try — can execute arbitrary code in the host JavaScript runtime. A payload built from the...

EUVD-2026-116111

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...

CVE-2026-44267

The Elo expression language for no-code tools is vulnerable to code execution prior to version 1.0.1 . Attackers can use .constructor.constructor in plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try to access the JavaScript Function constructor. This occurs be...

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the character. Because begins Ruby's interpolation sequences — expr, @ivar, @@cvar, $gvar — and any expression wrapped in ... may use backticks for shell execution, an Elo program that...

EUVD-2026-116110

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...

CVE-2026-44266

The Elo expression language (versions prior to 1.0.1 ) contains a vulnerability in its Ruby backend (src/compilers/ruby.ts). The issue arises because attacker-controlled text is embedded into Ruby double-quoted strings without escaping the # character. This allows Ruby interpolation forms in the ...

CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...

Elo backends have code injection via unvalidated emission of programmatic AST fields

Summary Elo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input,...

CVE-2026-44265

The Elo expression language for no-code tools (versions prior to 1.0.1 ) contains a vulnerability in its programmatic AST API . The system fails to perform runtime syntax validation when interpolating arbitrary values from JSON-deserialized input , plugin outputs, or other untyped sources into ge...

EUVD-2026-116108

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax...

CVE-2026-45396 Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses modelconfig = ConfigDictextra='allow'. Due to an...

EUVD-2024-45479

Malicious code in bioql PyPI...

CVE-2024-51678

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through 1.0.3...

CVE-2024-51678 WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678 WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

WordPress plugin Elo Rating Shortcode cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-51678: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...