Arbitrary code execution via eval-built constructor

Code injection in PixlCore pixl-class before 1.0.3 allows remote attackers to execute arbitrary JavaScript via a crafted parent-class member. The create function converts members.__parent to source text, extracts its arguments and body, and concatenates them into an eval-built constructor without validating that the value is a function. Exploitation requires a consuming Node.js application to pass attacker-controlled members into Class.create, and injected code runs with that application's process privileges.