[ Vendor · 3 CVEs ]
enspirit
CVEs affecting enspirit published in the last 30 days, plus any enspirit CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-44267 | 3 Nov 2026 | CVSS 9.8 | Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accessElo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo… | Fix |
| CVE-2026-44265 | 3 Nov 2026 | CVSS 7.4 | Elo backends have code injection via unvalidated emission of programmatic AST fieldsElo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from… | Fix |
| CVE-2026-44266 | 3 Nov 2026 | CVSS 9.8 | Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsElo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds… | Fix |