AI analysis
Claude Opus · 8 Nov 2026, 10:21 CET
Elo expression language Ruby backend allows code execution through unescaped string interpolation
The Ruby compilation target of the Elo expression language (npm package @enspirit/elo, versions up to 1.0.0) lets untrusted Elo expressions run Ruby code and shell commands. Upgrade to 1.0.1, especially where users can submit expressions.
In plain terms
Elo is a small expression language used inside no-code tools. People write Elo expressions, and Elo can translate ("compile") them into other programming languages, including Ruby, JavaScript, Python and SQL. In versions up to 1.0.0, the translation to Ruby does not properly neutralise a special Ruby syntax that runs code embedded inside text. An attacker who can supply an Elo expression can therefore make the generated Ruby program run commands of their choosing.
This matters to anyone who uses the @enspirit/elo package with the Ruby target, especially if expressions come from end users, customers or other untrusted sources. Teams that only compile Elo to JavaScript, Python or SQL are not affected by this specific problem, according to the advisory.