Threats tagged 'ghsa-x9rp-7wh3-2rj5'

CVE-2026-44265 is a code injection vulnerability in the @enspirit/elo library's programmatic AST API. The API accepts arbitrary values in many AST node fields without runtime validation, leading to unescaped interpolation into generated source code across JavaScript, Ruby, Python, and SQL backends. This allows attackers to inject arbitrary code or expressions, resulting in remote code execution or SQL injection. The issue affects all versions prior to 1.0.1 and was fixed in version 1.0.1. The vulnerability was verified with proof-of-concept exploits demonstrating code execution and SQL injection in all affected backends.