I have seen a lot of attacks using it on the server side, like: -innocuous looking code merges user supplied input from a json object ("we just use this to ren

I have seen a lot of attacks using it on the server side, like: -innocuous looking code merges user supplied input from a json object ("we just use this to render a view or write it to an object store") -attacker throws in a __proto__ property which means every object in the _entire_ node runtime has that value for that key until it's overwritten in script -random templating engine has a config option that would _never_ be controlled by an attacker, right? -oops, RCE!