CPE
Elo versions prior to 1.0.1 allow arbitrary code execution because the transformation logic fails to reject .constructor properties in plain string inputs, enabling breakouts into the JavaScript host environment.