Official RopeTwo Discussion

I’ve probably missed something obvious for the initial foothold. I’ve spotted the vuln in the repo and know the general direction to exploit it. The only problem is it’s a client-side vuln. How exactly am I supposed to obtain an RCE from it?