DOJO CHALLENGE #13 Winners!

This DOJO Challenge #13 write-up explains how an attacker can use prototype pollution (via constructor.prototype as an alternative to __proto__) to place a code property on an object's prototype so that a blacklist-based deletion of options.code fails, allowing execution of arbitrary JavaScript through new Function; the report includes source code, step-by-step analysis, a PoC JSON payload, and references.