CVE-2026-44266: CVE-2026-44266: Remote Code Execution in @enspirit/elo Ruby Compiler Backend via Unescaped String Interpolation

Two vulnerabilities affect @enspirit/elo prior to version 1.0.1. CVE-2026-44266 is a code injection flaw in the Ruby compiler backend caused by unescaped hash characters, allowing arbitrary code execution with a CVSS score of 9.8. Additionally, CVE-2026-44265 involves code and SQL injection via the programmatic AST API. This occurs because JavaScript, Ruby, Python, and PostgreSQL emitters lack runtime type validation, enabling attackers to inject commands when AST nodes are constructed from untrusted sources.