3 Total advisories
3 Vulnerabilities
0 Malware
Dependency scanning
Check whether @enspirit/elo is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
HIGH 7.4
CVE-2026-44265
Elo backends have code injection via unvalidated emission of programmatic AST fields
CRITICAL 9.8
CVE-2026-44266
Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
CRITICAL 9.8
CVE-2026-44267
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
Browse more npm advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes