50-250 rep for solving challenges using an ACE exploit in an esoteric language

I've reached 1500 rep, so here's a bounty for you RE/CTF enthusiasts for an answer I really want to see.

CVE-2018-6849: Code execution results in code execution
— TheZZAZZGlitch, "A friendly reminder: Lua scripts are arbitrary code", YouTube

Esoteric language interpreters and compilers are often pretty shoddily written. It is usually shrugged off because "nobody is going to use it for anything serious".

Your goal:

1. Find an existing interpreter, translator, or compiler for an esoteric language published before January 2021. Preferably, this should have an entry on esolangs.org or be under the "Recreational" category on TIO.
2. Find a bug in the interpreter, compiler, or generated code that allows you to escape the language and execute arbitrary code. This can be direct code execution, launching a shell, cross-site scripting, return oriented programming, making compilers emit arbitrary code, or something similar. If you can execute arbitrary code in the compiler itself, that counts as well.
3. Explain the bug (and, preferably, explain a way to fix it if it hasn't been patched)
4. Solve a code challenge posted before January 2021 using code executed from that exploit instead of the tools provided by the language.
5. Also be sure to explain the payload itself.

To be clear: You are only allowed to use features provided by the language to set up the payload and exploit. The logic to solve the puzzle must be entirely in the payload.

However, you are allowed to execute some code from the interpreter/compiler itself in the payload, e.g. for input and output or ROP chaining.

The following do not count:

• Exploits that just run the interpreter on arbitrary code in the same language. You must demonstrate full control over the interpreter.
• Exploits caused by the code you wrote. The code you wrote must only exploit the bug.
• Tools in the language intended to execute code (e.g. execve()/system() in C or things like eval()).
• Bugs in third party code or the programming language that the interpreter/compiler uses. (e.g. exploiting a Node.js bug in an interpreter written in JavaScript)
• Code challenges that are simply "crash the program" or the like: It should be something interesting.

Older releases of an interpreter/compiler are fine.

Since these are very system specific, please either provide an online demo or a Docker image. You are required to provide the exact build instructions in the latter case.

Custom compiler flags for building interpreters follow the same loophole rules.

See some of my answers for Shortest code that raises a SIGSEGV which highlight some interpreter bugs I found for a starting point.

While I may not be able to award immediately, I will try to award anywhere from 50-250 rep, depending on how much you impress me. Finding new exploits is strongly encouraged instead of using the same one over and over.

Take that Phooey freebie while you can!

Add a comment here or ping me in chat if I (likely) don't notice your post.