GHSA-mpcw-3j5p-p99x: Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

Usage of the Butterfly.prototype.parseJSON or getJSON functions on an attacker-controlled crafted input string allows the attacker to execute arbitrary JavaScript code on the server.

Since Butterfly JavaScript code has access to Java classes, it can run arbitrary programs.