CVE-2025-55346

CVE-2025-55346 involves an improper control of code generation, specifically a vulnerability in a dynamic Function constructor. User-controlled input flows to an unsafe implementation, which allows network attackers to run arbitrary, unsandboxed JavaScript code within the host's context. This is achieved by sending a simple POST request. The vulnerability allows a remote attacker to execute arbitrary JavaScript code without requiring any user interaction. This can lead to a complete system compromise, unauthorized access to sensitive data, manipulation of application functionality, and potential lateral movement within the network.