# Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Elo's Ruby backend fails to escape `#` in emitted double-quoted strings, so crafted Elo string literals or subtype labels compile to Ruby that executes shell commands.

- Payout: Research
- Severity: critical
- Program: Elo
- Found by: ultra-supara
- Disclosed: 2026-11-03
- CVE: CVE-2026-44266
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7w38-ggh5-v542
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7w38-ggh5-v542
- Tags: area:oss domain:oss impact:rce kind:research platform:ghsa sev:critical tech:ruby technique:parser-differential technique:source-review vuln:command-injection vuln:rce

**Target:** Ruby code emitter in Elo compiler (src/compilers/ruby.ts)
**Root cause:** The Ruby emitter's double-quoted-string escape routine omits `#`, and the labelled subtype-constraint branch performs no escape pass at all, letting `#{...}` interpolation reach emitted Ruby source.
**Steps:**
1. Craft Elo source with a string literal containing interpolation: `'RES=#{`id 2>&1`}'`
2. Compile with `eloc -t ruby -x poc.elo`; emitted Ruby contains `"RES=#{`id 2>&1`}"`
3. Run emitted Ruby; backtick command executes, returning `id` output
4. Alternate sink: `let X = Int(i | '#{`touch /tmp/pwned2`}': i > 0) in X(-1)` — failing predicate triggers `p_fail(p, "#{...}")` interpolation
**How found:** Code review of the Ruby emitter's escape routine noticed `#` missing from the escaped character set, and the subtype-label branch had no escape pass; parser accepts single-quoted labels that flow unchanged into emitted Ruby.
**Exploitation:** Attacker supplies Elo source to any Ruby-targeting consumer (playground /try, eloc CLI on CI host, or library API parse+emit); the emitted Ruby interpolates attacker expression, and backticks give shell execution at runtime.
**Insight:** When auditing code generators, check that each target language's interpolation sigils (`#{}` in Ruby, `${}` in JS, `{}` in Python f-strings) are escaped in every string-emission path — including error-message and label branches that bypass the main escape helper.

## Proof of concept (copied exactly from the original report)

**eloc command emitting vulnerable Ruby**

```
$ eloc -t ruby -x poc.elo
# emitted Ruby contains:  "RES=#{`id 2>&1`}"
# running it returns the output of id(1).
```

**Subtype-constraint label injection PoC**

```
let X = Int(i | '#{`touch /tmp/pwned2`}': i > 0) in X(-1)
```