CVE-2026-44266: CVE-2026-44266: Remote Code Execution in @enspirit/elo Ruby Compiler Backend via Unescaped String Interpolation

CVE-2026-44266 represents a critical remote code execution vulnerability affecting the @enspirit/elo Ruby compiler backend prior to version 1.0.1. The issue arises from the failure to escape the hash character (#) within double-quoted Ruby string literals when compiling untrusted Elo expressions. This oversight enables attackers to inject and execute arbitrary Ruby code and shell commands by exploiting the unescaped string interpolation mechanism.

The vulnerability falls under the categories of code injection and remote code execution, as classified by CWE-94, CWE-116, and CWE-1336. Affected systems include the @enspirit/elo npm package and its accompanying Elo CLI tool when utilizing the Ruby target (-t ruby) for compiling untrusted input. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.

The fix was introduced in version 1.0.1, which includes an escapeRubyDQ function to properly escape # characters in double-quoted strings. Users are advised to upgrade to the patched version, invalidate and regenerate any cached or pre-compiled Ruby code, avoid using the Ruby backend (-t ruby) for untrusted input, and isolate the execution of compiled expressions within restricted sandboxes.