
New Method Discovered to Invoke JavaScript Functions Without Parentheses
JavaScriptsecurityprototype pollutioncode injectionvulnerabilityresearch
A researcher discovered a new method to invoke JavaScript functions without using parentheses. The technique involves overwriting the Error.prepareStackTrace method with the function constructor, then using prototype pollution to inject valid JavaScript code that generates arbitrary functions, which can then be invoked using existing tricks.