50 rep for solving a challenge using an ACE exploit

I've reached 1000 rep, so here's a small bounty for you RE/CTF enthusiasts for an answer I really want to see.

CVE-2018-6849: Code execution results in code execution
— TheZZAZZGlitch, "A friendly reminder: Lua scripts are arbitrary code", YouTube

Esoteric language interpreters and compilers are often pretty shoddily written. It is usually shrugged off because "nobody is going to use it for anything serious".

Your goal:

1. Find an existing interpreter, translator, or compiler published before January 2021. Preferably, this should be some esoteric language instead of something professional.
2. Find a bug in the interpreter, compiler, or generated code that allows some form of arbitrary code execution, such as direct code execution, launching a shell, cross-site scripting, return oriented programming, or something similar.
3. Explain the bug (and, preferably, explain a way to fix it if it hasn't been patched)
4. Solve a code challenge posted before January 2021 using code executed from that exploit instead of the tools provided by the language.
5. Also be sure to explain the payload itself.

To be clear: You are only allowed to use features provided by the language to set up the payload and exploit. The logic to solve the puzzle must be entirely in the payload.

However, you are allowed to execute some code from the interpreter/compiler itself in the payload, e.g. for input and output or ROP chaining.

The following do not count:

• Exploits caused by the code you wrote. The code you wrote must only exploit the bug.
• Tools in the language intended to execute code (e.g. execve()/system() in C).
• Bugs in third party code that the interpreter/compiler uses
• Code challenges that are simply "crash the program" or the like: It should be something interesting.

Older releases of an interpreter/compiler are fine.

Since these are very system specific, please either provide an online demo or a Docker image. You are required to provide the exact build instructions in the latter case.

Custom compiler flags for building interpreters follow the same loophole rules.

See some of my answers for Shortest code that raises a SIGSEGV which highlight some interpreter bugs I found for a starting point.

Add a comment here or ping me in chat if I (likely) don't notice your post.