RCE via Prototype Pollution in Blitz.js