Please see original writeup here:
https://www.youtube.com/watch?v=diln4KD57xA

Solution:
1. Bypass filtering with delimiter on nodejs render call
2. SSTI into EJS
3. Profit