"If Object.prototype.toString can be polluted ... and instructs EJS (should it be in use) to launch a Node.js "child_process." This newly launched process further spawns a reverse shell to ...