Comment by f311a
9 hours ago
This reminds me of the old days when PHP was such a vulnerable language.
By simply searching for websites that used local includes to load other pages, you could get RCE.
At this point, running webapps in JS workers/sandboxes sounds like a good idea. Vendors take care of patching.
Have a search for V8 RCE/CVEs over the past year.
That's why I mentioned vendors. They patch it before announcements.
Also, sandboxing makes automatic exploitation harder. There is no FS persistence, so some checks simply do not pass.