I created a custom test step that may be able to help with this. It requires 3 input values.
Filed Name: The filed you want to get from the record (In this test case it will be most likely cmdb_ci)
Table: What table the field is no (sn_vul_vulnerability_item)
Record: sys_id of the record you need to get the field from. (sys_id of the variability record you want the configuration item from)
Then there is one output value which in you case should have the sys_id of the configuration item field.
Note: That I have my output to return a string. You may need to change that to return a document id as the field to properly use this in future test steps.
Below is the script in Step Execution script section.
(function executeStep(inputs, outputs, stepResult, timeout) {
var tableName = inputs.u_table.toString();
var recordID = inputs.u_record.toString();
var fieldName = inputs.u_field_name.toString();
var currentRecord = new GlideRecord(tableName);
var recordFound = currentRecord.get(recordID);
outputs.u_field_value = currentRecord[fieldName].toString();
//gs.log('Problem Number: ' + outputs.u_field_value);
stepResult.setSuccess(true);
}(inputs, outputs, stepResult, timeout));
