Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — defaultFormats.elo.parse, the bin/elo CLI, or the live browser playground at elo-lang.org/try — can execute arbitrary code in the host JavaScript runtime. A payload built from the...