&gt; The problem is that JS is really easy to make mistakes in because of silent errors, dynamic typing, type coercion, etc.<p>All those are not a factor in this instance. It seems to me it&#x27;s a result of calling exec() on unscrubbed user input, and this can be done in <i>any</i> language.