Three Activepieces CVEs, two of which execute before the V8 isolate exists. The sandbox timeline, the mode matrix, and why require() runs the module.