Enspirit vulnerabilities
We track 3 vulnerabilities in Enspirit products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest Enspirit vulnerabilities
- 9.8 Critical severity
elo: Improper Neutralization of Input During Web Page Generation
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access han
- 9.8 Critical severity
elo: Improper Control of Generation of Code
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emit
- 7.4 High severity
Elo is a purely functional expression language for no-code tools.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, P