When Deserialization Meets eval(): Anatomy of a Full-Stack CompromiseHack the Box: InterpreterFeb 26, 2026·5 min read·17