CVE-2026-44267

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...