CVE-2020-7640: OS Command Injection in pixl-class

The vulnerability stems from how the create function handles the 'members.__parent' property. In vulnerable versions (<1.0.3), it extracts code from __parent.toString(), builds a constructor string via concatenation, and executes it with eval(). This allows attackers to control the executed code by crafting malicious __parent values. The patch in 1.0.3 replaces this dangerous eval() pattern with Function.prototype.apply() for safe inheritance, confirming the vulnerability location. The Snyk POC and commit diff directly implicate this code path.