Javascript — eval() can be used to inject and execute arbitrary code Code Injection To list the files in the current directory: require('child_process').execSync('ls').toString() To get the current working directory: process.cwd()