I feel like there are a lot of CVE's in the JS community that basically require an attacker to already have access to server side code execution. That seems lik

I feel like there are a lot of CVE's in the JS community that basically require an attacker to already have access to server side code execution. That seems like it raises some bigger questions.