Exploiting a QuickJS-ng fast-array bug to expose stale JSValues, corrupt the global property table, and call std.loadFile
Turning a missing pyjnius type check into Java object confusion, native memory access, and code execution through a forged PyObject
![[SAS CTF 2026] JSculator writeup](/_astro/SAS26.C8H7_A0o_28emzr.webp)