Dojo challenge #32 winners!

## Executive Summary This write-up describes a Python Class Pollution vulnerability in a web application's merge_config function that lets a crafted JSON payload mutate class internals (via attributes like __class__ and __globals__) to overwrite a COMMAND variable and achieve remote code execution; the author demonstrates a proof-of-concept that reads /tmp/flag.txt and provides mitigation advice including input validation and attribute access restriction.