A critical vulnerability in the Elo JavaScript emitter allows unauthenticated attackers to execute arbitrary code in the host JavaScript runtime. The flaw arises from unfiltered use of the `.constructor` property in Elo expressions, enabling sandbox escape and remote code execution (RCE) in Node.js and browser environments. This affects the Elo CLI, the browser playground at elo-lang.org, and the library API. The vulnerability is fixed in version 1.0.1.