vMix 29: Unauthenticated Administrator RCE via VBScript Blocklist Bypass

vMix 29 sandboxes user VB.NET scripts with a 6-item substring blocklist, but the compilation template pre-imports System.Diagnostics, so an attacker calls Process.Start directly without writing the blocked substring. With the Web Controller's default blank password, /api is unauthenticated — unauthenticated RCE as the vMix64.exe user (commonly administrator).