OpenCTI JSON Mapper safeEjs Sandbox Escape RCE

OpenCTI is an open source cyber threat intelligence platform built as a Node.js GraphQL application. Its data-mapping feature lets a user attach an EJS "formula" to a JSON mapper attribute, which the backend renders through a home-grown sandbox safeEjs that is intended to allow only arithmetic an...