Tag
A blog post demonstrates another technique for invoking arbitrary JavaScript functions without parentheses by overwriting Error.prepareStackTrace with the Function constructor and controlling Array.prototype.toString, combined with prototype pollution and the valueOf trick to execute arbitrary code.
This CVE describes a prototype pollution vulnerability in n8n that can be exploited for remote code execution through a Git node gadget chain.