Review Node child_process and dynamic requires
exec with a string, dynamic require, and vm without a sandbox are the Node sinks that turn input into code.
Tag: nodejs
Server-side prototype pollution to RCE in Node
A polluted Object.prototype can inject options into a later child_process call, turning a merge bug into command execution.