This reminds me of the old days when PHP was such a vulnerable language.

By simply searching for websites that used local includes to load other pages, you could get RCE.

At this point, running webapps in JS workers/sandboxes sounds like a good idea. Vendors take care of patching.

Have a search for V8 RCE/CVEs over the past year.

	▲	f311a a day ago \| parent [-]
		That's why I mentioned vendors. They patch it before announcements. Also, sandboxing makes automatic exploitation harder. There is no FS persistence, so some checks simply do not pass.