CVE-2020-28478

This PoC demonstrates a prototype pollution vulnerability in gsap 1.19.90, where malicious input via `gsap.config` can pollute the global object prototype chain. The exploit uses JSON parsing to inject properties into `__proto__`, leading to potential arbitrary code execution or data manipulation.