AIKIDO-2026-10165
@enspirit/elo is vulnerable to Code Injection
93
Critical Risk
This Affects:
@enspirit/eloTL;DR
Affected versions of this package have a code injection vulnerability in the literal emitters for date, datetime, and duration constructs: the compiler interpolated unescaped values directly into generated code or SQL, allowing crafted input via the programmatic AST API to break out of string literals and inject arbitrary code. The patched version ensures proper escaping (using JSON.stringify for JS/Ruby and doubled single quotes for SQL) and adds security regression tests to prevent this class of injection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@enspirit/elo is vulnerable to Code Injection in versions 0.0.1 - 0.9.6.
How to fix this
Upgrade the @enspirit/elo library to the patch version.
Background Info
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant