Critical Security Fix: Prevent Remote Code Execution (RCE) in invite_users_to_challenge() (Replace eval() with json.loads())

A critical Remote Code Execution (RCE) vulnerability was identified in `apps/challenges/views.py` inside the `invite_users_to_challenge()` function (around line ~3090). The issue was caused by unsafe usage of Python’s `eval()` on user-controlled input (`request.data.get("emails")`), which allowed attackers to execute arbitrary code on the server. To fix this, the dangerous `eval()` call was replaced with `json.loads()` and additional type validation was added to ensure the input is always a list of email addresses. Exception handling was also improved, including handling for `ChallengeHost.MultipleObjectsReturned`, preventing potential crashes or DoS scenarios from database integrity issues. This patch fully eliminates the RCE attack vector, improves reliability, and ensures malicious payloads like `__import__('os').system('whoami')` now fail safely with a proper 400 Bad Request response.

Start in apps/challenges/views.py at invite_users_to_challenge() around line 3090 and inspect how request.data.get("emails") is parsed and validated. Verify that malformed or malicious input produces a 400 response, that only a list of email addresses is accepted, and that ChallengeHost.MultipleObjectsReturned is handled safely.

Written by the indexing model from the issue text.