I saw that vuln categorized as “RCE” and had the same reaction. IIRC it was prototype pollution in an npm package during json deserialization - if you are letti

I saw that vuln categorized as “RCE” and had the same reaction. IIRC it was prototype pollution in an npm package during json deserialization - if you are letting attackers define javascript functions in your nodejs process, you have almost certainly already lost. The details were vague at the time so I had hoped I was just missing context.