CVE-2026-44267

The Elo expression language for no-code tools is vulnerable to code execution prior to version 1.0.1 . Attackers can use .constructor.constructor in plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try to access the JavaScript Function constructor. This occurs be...